diff options
| author | Stefano Stabellini | 2015-12-18 16:09:58 +0100 |
|---|---|---|
| committer | Stefano Stabellini | 2015-12-18 16:09:58 +0100 |
| commit | f9e98e5d7a67367b862941e339a98b8322fa0cea (patch) | |
| tree | 8139588be82cb11f0f6d0720833d577db7b57f07 | |
| parent | configure: Fix shell syntax to placate OpenBSD's pdksh (diff) | |
| download | qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.tar.gz qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.tar.xz qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.zip | |
xen/blkif: Avoid double access to src->nr_segments
src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function. If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.
Fix it by removing the double access to src->nr_segments.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
| -rw-r--r-- | hw/block/xen_blkif.h | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/hw/block/xen_blkif.h b/hw/block/xen_blkif.h index 711b692742..c68487cb31 100644 --- a/hw/block/xen_blkif.h +++ b/hw/block/xen_blkif.h @@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque d->nr_sectors = s->nr_sectors; return; } - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + barrier(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } @@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque d->nr_sectors = s->nr_sectors; return; } - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + barrier(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } |