| From foo@baz Mon Nov 29 07:12:46 PM CET 2021 |
| From: Juergen Gross <jgross@suse.com> |
| Date: Mon, 29 Nov 2021 16:02:34 +0100 |
| Subject: tty: hvc: replace BUG_ON() with negative return value |
| |
| From: Juergen Gross <jgross@suse.com> |
| |
| commit e679004dec37566f658a255157d3aed9d762a2b7 upstream. |
| |
| Xen frontends shouldn't BUG() in case of illegal data received from |
| their backends. So replace the BUG_ON()s when reading illegal data from |
| the ring page with negative return values. |
| |
| Reviewed-by: Jan Beulich <jbeulich@suse.com> |
| Signed-off-by: Juergen Gross <jgross@suse.com> |
| Link: https://lore.kernel.org/r/20210707091045.460-1-jgross@suse.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/tty/hvc/hvc_xen.c | 17 ++++++++++++++--- |
| 1 file changed, 14 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/tty/hvc/hvc_xen.c |
| +++ b/drivers/tty/hvc/hvc_xen.c |
| @@ -98,7 +98,11 @@ static int __write_console(struct xencon |
| cons = intf->out_cons; |
| prod = intf->out_prod; |
| mb(); /* update queue values before going on */ |
| - BUG_ON((prod - cons) > sizeof(intf->out)); |
| + |
| + if ((prod - cons) > sizeof(intf->out)) { |
| + pr_err_once("xencons: Illegal ring page indices"); |
| + return -EINVAL; |
| + } |
| |
| while ((sent < len) && ((prod - cons) < sizeof(intf->out))) |
| intf->out[MASK_XENCONS_IDX(prod++, intf->out)] = data[sent++]; |
| @@ -126,7 +130,10 @@ static int domU_write_console(uint32_t v |
| */ |
| while (len) { |
| int sent = __write_console(cons, data, len); |
| - |
| + |
| + if (sent < 0) |
| + return sent; |
| + |
| data += sent; |
| len -= sent; |
| |
| @@ -150,7 +157,11 @@ static int domU_read_console(uint32_t vt |
| cons = intf->in_cons; |
| prod = intf->in_prod; |
| mb(); /* get pointers before reading ring */ |
| - BUG_ON((prod - cons) > sizeof(intf->in)); |
| + |
| + if ((prod - cons) > sizeof(intf->in)) { |
| + pr_err_once("xencons: Illegal ring page indices"); |
| + return -EINVAL; |
| + } |
| |
| while (cons != prod && recv < len) |
| buf[recv++] = intf->in[MASK_XENCONS_IDX(cons++, intf->in)]; |