Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18779149 authored by Roger Pau Monné's avatar Roger Pau Monné Committed by Konrad Rzeszutek Wilk
Browse files

xen-blkback: read from indirect descriptors only once 



Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

CC: stable@vger.kernel.org
Signed-off-by: default avatarRoger Pau Monné <roger.pau@citrix.com>
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
parent 1f13d75c

drivers/block/xen-blkback/blkback.c

+10 −5
Original line number Diff line number Diff line
@@ -950,6 +950,8 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req, 
		goto unmap;



	for (n = 0, i = 0; n < nseg; n++) {

		uint8_t first_sect, last_sect;



		if ((n % SEGS_PER_INDIRECT_FRAME) == 0) {

			/* Map indirect segments */

			if (segments)
@@ -957,15 +959,18 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req, 
			segments = kmap_atomic(pages[n/SEGS_PER_INDIRECT_FRAME]->page);

		}

		i = n % SEGS_PER_INDIRECT_FRAME;



		pending_req->segments[n]->gref = segments[i].gref;

		seg[n].nsec = segments[i].last_sect -

			segments[i].first_sect + 1;

		seg[n].offset = (segments[i].first_sect << 9);

		if ((segments[i].last_sect >= (XEN_PAGE_SIZE >> 9)) ||

		    (segments[i].last_sect < segments[i].first_sect)) {



		first_sect = READ_ONCE(segments[i].first_sect);

		last_sect = READ_ONCE(segments[i].last_sect);

		if (last_sect >= (XEN_PAGE_SIZE >> 9) || last_sect < first_sect) {

			rc = -EINVAL;

			goto unmap;

		}



		seg[n].nsec = last_sect - first_sect + 1;

		seg[n].offset = first_sect << 9;

		preq->nr_sects += seg[n].nsec;

	}