On 17.12.20 09:17, SeongJae Park wrote:
> From: SeongJae Park <sjpark@amazon.de>
> 
> This commit adds a counter of pending messages for each watch in the
> struct.  It is used to skip unnecessary pending messages lookup in
> 'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
> callback.
> 
> This is part of XSA-349
> 
> This is upstream commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: SeongJae Park <sjpark@amazon.de>
> Reported-by: Michael Kurth <mku@amazon.de>
> Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
> Signed-off-by: Author Redacted <security@xen.org>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Signed-off-by: Juergen Gross <jgross@suse.com>
> ---
>   drivers/xen/xenbus/xenbus_xs.c | 30 ++++++++++++++++++------------
>   include/xen/xenbus.h           |  2 ++
>   2 files changed, 20 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
> index 0ea1c259f2f1..420d478e1708 100644
> --- a/drivers/xen/xenbus/xenbus_xs.c
> +++ b/drivers/xen/xenbus/xenbus_xs.c
> @@ -701,6 +701,8 @@ int register_xenbus_watch(struct xenbus_watch *watch)
>   
>   	sprintf(token, "%lX", (long)watch);
>   
> +	watch->nr_pending = 0;
> +

I'm missing the incrementing of nr_pending, which was present in the
upstream patch.


Juergen

>   	down_read(&xs_state.watch_mutex);
>   
>   	spin_lock(&watches_lock);
> @@ -750,12 +752,15 @@ void unregister_xenbus_watch(struct xenbus_watch *watch)
>   
>   	/* Cancel pending watch events. */
>   	spin_lock(&watch_events_lock);
> -	list_for_each_entry_safe(msg, tmp, &watch_events, list) {
> -		if (msg->u.watch.handle != watch)
> -			continue;
> -		list_del(&msg->list);
> -		kfree(msg->u.watch.vec);
> -		kfree(msg);
> +	if (watch->nr_pending) {
> +		list_for_each_entry_safe(msg, tmp, &watch_events, list) {
> +			if (msg->u.watch.handle != watch)
> +				continue;
> +			list_del(&msg->list);
> +			kfree(msg->u.watch.vec);
> +			kfree(msg);
> +		}
> +		watch->nr_pending = 0;
>   	}
>   	spin_unlock(&watch_events_lock);
>   
> @@ -802,7 +807,6 @@ void xs_suspend_cancel(void)
>   
>   static int xenwatch_thread(void *unused)
>   {
> -	struct list_head *ent;
>   	struct xs_stored_msg *msg;
>   
>   	for (;;) {
> @@ -815,13 +819,15 @@ static int xenwatch_thread(void *unused)
>   		mutex_lock(&xenwatch_mutex);
>   
>   		spin_lock(&watch_events_lock);
> -		ent = watch_events.next;
> -		if (ent != &watch_events)
> -			list_del(ent);
> +		msg = list_first_entry_or_null(&watch_events,
> +				struct xs_stored_msg, list);
> +		if (msg) {
> +			list_del(&msg->list);
> +			msg->u.watch.handle->nr_pending--;
> +		}
>   		spin_unlock(&watch_events_lock);
>   
> -		if (ent != &watch_events) {
> -			msg = list_entry(ent, struct xs_stored_msg, list);
> +		if (msg) {
>   			msg->u.watch.handle->callback(
>   				msg->u.watch.handle,
>   				(const char **)msg->u.watch.vec,
> diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
> index 1772507dc2c9..ed9e7e3307b7 100644
> --- a/include/xen/xenbus.h
> +++ b/include/xen/xenbus.h
> @@ -58,6 +58,8 @@ struct xenbus_watch
>   	/* Path being watched. */
>   	const char *node;
>   
> +	unsigned int nr_pending;
> +
>   	/*
>   	 * Called just before enqueing new event while a spinlock is held.
>   	 * The event will be discarded if this callback returns false.
>