tree a247aa02c54e789146dc05dc4e1a794ad2b7c111
parent 1f13d75ccb806260079e0679d55d9253e370ec8a
author Roger Pau Monné <roger.pau@citrix.com> 1446568843 +0000
committer Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> 1450450837 -0500

xen-blkback: read from indirect descriptors only once

Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

CC: stable@vger.kernel.org
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>