lkml.org 
[lkml]   [2016]   [Jan]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 111/160] xen-blkback: only read request operation from shared ring once
    Date
    3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>

    commit 1f13d75ccb806260079e0679d55d9253e370ec8a upstream.

    A compiler may load a switch statement value multiple times, which could
    be bad when the value is in memory shared with the frontend.

    When converting a non-native request to a native one, ensure that
    src->operation is only loaded once by using READ_ONCE().

    This is part of XSA155.

    Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/block/xen-blkback/common.h | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
    index f65b807..d179195 100644
    --- a/drivers/block/xen-blkback/common.h
    +++ b/drivers/block/xen-blkback/common.h
    @@ -391,8 +391,8 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
    struct blkif_x86_32_request *src)
    {
    int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
    - dst->operation = src->operation;
    - switch (src->operation) {
    + dst->operation = READ_ONCE(src->operation);
    + switch (dst->operation) {
    case BLKIF_OP_READ:
    case BLKIF_OP_WRITE:
    case BLKIF_OP_WRITE_BARRIER:
    @@ -439,8 +439,8 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
    struct blkif_x86_64_request *src)
    {
    int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
    - dst->operation = src->operation;
    - switch (src->operation) {
    + dst->operation = READ_ONCE(src->operation);
    + switch (dst->operation) {
    case BLKIF_OP_READ:
    case BLKIF_OP_WRITE:
    case BLKIF_OP_WRITE_BARRIER:
    --
    1.9.1

    \
     
     \ /
      Last update: 2016-01-20 03:01    [W:2.264 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site