Roger Pau Monné 1877914910 xen-blkback: read from indirect descriptors only once
Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

CC: stable@vger.kernel.org
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2015-12-18 10:00:37 -05:00
..
2015-10-02 11:05:58 +09:00
2015-10-02 14:46:15 -04:00
2015-09-11 16:21:12 -07:00
2015-10-15 13:44:35 -07:00
2015-10-13 10:09:59 -07:00
2015-09-08 14:35:59 -07:00
2015-09-03 16:41:38 -07:00
2015-09-11 16:42:39 -07:00
2015-09-08 17:22:35 -07:00
2015-10-16 12:07:43 -07:00
2015-10-07 09:35:15 +01:00
2015-09-17 21:41:02 -07:00
2015-09-09 10:55:32 -07:00
2015-09-05 19:37:31 +02:00
2015-09-18 09:28:20 -07:00
2015-10-11 10:02:30 -07:00
2015-09-21 12:02:27 -07:00
2015-10-23 14:20:37 +01:00
2015-09-18 09:28:20 -07:00
2015-10-07 14:13:59 +03:00