Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1375998

[PATCH 3.12 10/98] xen-blkback: read from indirect descriptors only once

Show all headers | View raw

From: Roger Pau Monné <roger.pau@citrix.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 18779149101c0dd43ded43669ae2a92d21b6f9cb upstream.

Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/block/xen-blkback/blkback.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 6beaaf83680e..77128dea547f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -853,6 +853,8 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
 		goto unmap;
 
 	for (n = 0, i = 0; n < nseg; n++) {
+		uint8_t first_sect, last_sect;
+
 		if ((n % SEGS_PER_INDIRECT_FRAME) == 0) {
 			/* Map indirect segments */
 			if (segments)
@@ -860,15 +862,18 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
 			segments = kmap_atomic(pages[n/SEGS_PER_INDIRECT_FRAME]->page);
 		}
 		i = n % SEGS_PER_INDIRECT_FRAME;
+
 		pending_req->segments[n]->gref = segments[i].gref;
-		seg[n].nsec = segments[i].last_sect -
-			segments[i].first_sect + 1;
-		seg[n].offset = (segments[i].first_sect << 9);
-		if ((segments[i].last_sect >= (PAGE_SIZE >> 9)) ||
-		    (segments[i].last_sect < segments[i].first_sect)) {
+
+		first_sect = READ_ONCE(segments[i].first_sect);
+		last_sect = READ_ONCE(segments[i].last_sect);
+		if (last_sect >= (PAGE_SIZE >> 9) || last_sect < first_sect) {
 			rc = -EINVAL;
 			goto unmap;
 		}
+
+		seg[n].nsec = last_sect - first_sect + 1;
+		seg[n].offset = first_sect << 9;
 		preq->nr_sects += seg[n].nsec;
 	}
 
-- 
2.8.1

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 00/98] 3.12.58-stable review Jiri Slaby <jslaby@suse.cz> - 2016-04-11 15:30 +0200
  Re: [PATCH 3.12 00/98] 3.12.58-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-11 15:40 +0200
    Re: [PATCH 3.12 00/98] 3.12.58-stable review Jiri Slaby <jslaby@suse.cz> - 2016-04-14 10:30 +0200
  [PATCH 3.12 01/98] ipr: Fix out-of-bounds null overwrite Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 18/98] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 23/98] KVM: SVM: add rdmsr support for AMD event registers Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 08/98] xen-netback: use RING_COPY_REQUEST() throughout Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 07/98] xen-netback: don't use last request to determine minimum Tx credit Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 03/98] ipv4: Don't do expensive useless work during inetdev destroy. Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 27/98] perf, nmi: Fix unknown NMI warning Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 14/98] sched: Fix race between task_group and sched_task_group Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 20/98] memcg: do not hang on OOM when killed by userspace OOM access to memory reserves Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 19/98] ALSA: seq: Fix leak of pool buffer at concurrent writes Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 09/98] xen-blkback: only read request operation from shared ring once Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 05/98] kernel: Provide READ_ONCE and ASSIGN_ONCE Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
      Re: [PATCH 3.12 05/98] kernel: Provide READ_ONCE and ASSIGN_ONCE Christian Borntraeger <borntraeger@de.ibm.com> - 2016-04-11 16:20 +0200
    [PATCH 3.12 06/98] xen: Add RING_COPY_REQUEST() Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 17/98] drivers/base/memory.c: fix kernel warning during memory hotplug on ppc64 Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 04/98] umount: Do not allow unmounting rootfs. Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 10/98] xen-blkback: read from indirect descriptors only once Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 02/98] ipr: Fix regression when loading firmware Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 15/98] Btrfs: skip locking when searching commit root Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
  Re: [PATCH 3.12 00/98] 3.12.58-stable review shuahkh <shuahkh@osg.sisa.samsung.com> - 2016-04-11 19:30 +0200

csiph-web