]> git.baikalelectronics.ru Git - kernel.git/commit
xen-blkback: read from indirect descriptors only once
authorRoger Pau Monné <roger.pau@citrix.com>
Tue, 3 Nov 2015 16:40:43 +0000 (16:40 +0000)
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Fri, 18 Dec 2015 15:00:37 +0000 (10:00 -0500)
commitc379c65db271cafd65adb921e180cbb3dba6ed4c
treea247aa02c54e789146dc05dc4e1a794ad2b7c111
parentb5d4275bfbb74a23056c77d9c9c34b9cb3149d47
xen-blkback: read from indirect descriptors only once

Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

CC: stable@vger.kernel.org
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
drivers/block/xen-blkback/blkback.c