xen-scsiback: safely copy requests
authorDavid Vrabel <david.vrabel@citrix.com>
Mon, 16 Nov 2015 18:02:32 +0000 (18:02 +0000)
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Fri, 18 Dec 2015 15:00:41 +0000 (10:00 -0500)
The copy of the ring request was lacking a following barrier(),
potentially allowing the compiler to optimize the copy away.

Use RING_COPY_REQUEST() to ensure the request is copied to local
memory.

This is part of XSA155.

CC: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
drivers/xen/xen-scsiback.c

index 9eeefd7cad41127dcade5d81c06647218abeaccc..2af9aa8f9b9386e0782252ed406db2efe3c77ea9 100644 (file)
@@ -727,7 +727,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                if (!pending_req)
                        return 1;
 
-               ring_req = *RING_GET_REQUEST(ring, rc);
+               RING_COPY_REQUEST(ring, rc, &ring_req);
                ring->req_cons = ++rc;
 
                err = prepare_pending_reqs(info, &ring_req, pending_req);