From: Stefano Stabellini Date: Fri, 20 Nov 2015 15:56:00 +0000 (-0500) Subject: blkif: Avoid double access to src->nr_segments X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=a82794b1d5a6da06062a333b1db404e2448345dd;p=people%2Fliuw%2Flibxenctrl-split%2Fqemu-xen-traditional.git blkif: Avoid double access to src->nr_segments src is stored in shared memory and src->nr_segments is dereferenced twice at the end of the function. If a compiler decides to compile this into two separate memory accesses then the size limitation could be bypassed. Fix it by removing the double access to src->nr_segments. This is part of XSA-155. Signed-off-by: Stefano Stabellini Signed-off-by: Konrad Rzeszutek Wilk --- diff --git a/hw/xen_blkif.h b/hw/xen_blkif.h index ca3a65b1..eb29cb12 100644 --- a/hw/xen_blkif.h +++ b/hw/xen_blkif.h @@ -79,8 +79,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } @@ -94,8 +96,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque dst->handle = src->handle; dst->id = src->id; dst->sector_number = src->sector_number; - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + xen_mb(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; }