Skip to content

Commit 089bc01

Browse files
jbeulichkonradwilk
authored andcommitted
xen-blkback: don't leak stack data via response ring
Rather than constructing a local structure instance on the stack, fill the fields directly on the shared ring, just like other backends do. Build on the fact that all response structure flavors are actually identical (the old code did make this assumption too). This is XSA-216. Cc: stable@vger.kernel.org Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
1 parent a24fa22 commit 089bc01

File tree

2 files changed

+17
-31
lines changed

2 files changed

+17
-31
lines changed

Diff for: drivers/block/xen-blkback/blkback.c

+12-11
Original file line numberDiff line numberDiff line change
@@ -1433,34 +1433,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring,
14331433
static void make_response(struct xen_blkif_ring *ring, u64 id,
14341434
unsigned short op, int st)
14351435
{
1436-
struct blkif_response resp;
1436+
struct blkif_response *resp;
14371437
unsigned long flags;
14381438
union blkif_back_rings *blk_rings;
14391439
int notify;
14401440

1441-
resp.id = id;
1442-
resp.operation = op;
1443-
resp.status = st;
1444-
14451441
spin_lock_irqsave(&ring->blk_ring_lock, flags);
14461442
blk_rings = &ring->blk_rings;
14471443
/* Place on the response ring for the relevant domain. */
14481444
switch (ring->blkif->blk_protocol) {
14491445
case BLKIF_PROTOCOL_NATIVE:
1450-
memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt),
1451-
&resp, sizeof(resp));
1446+
resp = RING_GET_RESPONSE(&blk_rings->native,
1447+
blk_rings->native.rsp_prod_pvt);
14521448
break;
14531449
case BLKIF_PROTOCOL_X86_32:
1454-
memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt),
1455-
&resp, sizeof(resp));
1450+
resp = RING_GET_RESPONSE(&blk_rings->x86_32,
1451+
blk_rings->x86_32.rsp_prod_pvt);
14561452
break;
14571453
case BLKIF_PROTOCOL_X86_64:
1458-
memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt),
1459-
&resp, sizeof(resp));
1454+
resp = RING_GET_RESPONSE(&blk_rings->x86_64,
1455+
blk_rings->x86_64.rsp_prod_pvt);
14601456
break;
14611457
default:
14621458
BUG();
14631459
}
1460+
1461+
resp->id = id;
1462+
resp->operation = op;
1463+
resp->status = st;
1464+
14641465
blk_rings->common.rsp_prod_pvt++;
14651466
RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify);
14661467
spin_unlock_irqrestore(&ring->blk_ring_lock, flags);

Diff for: drivers/block/xen-blkback/common.h

+5-20
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues;
7575
struct blkif_common_request {
7676
char dummy;
7777
};
78-
struct blkif_common_response {
79-
char dummy;
80-
};
78+
79+
/* i386 protocol version */
8180

8281
struct blkif_x86_32_request_rw {
8382
uint8_t nr_segments; /* number of segments */
@@ -129,14 +128,6 @@ struct blkif_x86_32_request {
129128
} u;
130129
} __attribute__((__packed__));
131130

132-
/* i386 protocol version */
133-
#pragma pack(push, 4)
134-
struct blkif_x86_32_response {
135-
uint64_t id; /* copied from request */
136-
uint8_t operation; /* copied from request */
137-
int16_t status; /* BLKIF_RSP_??? */
138-
};
139-
#pragma pack(pop)
140131
/* x86_64 protocol version */
141132

142133
struct blkif_x86_64_request_rw {
@@ -193,18 +184,12 @@ struct blkif_x86_64_request {
193184
} u;
194185
} __attribute__((__packed__));
195186

196-
struct blkif_x86_64_response {
197-
uint64_t __attribute__((__aligned__(8))) id;
198-
uint8_t operation; /* copied from request */
199-
int16_t status; /* BLKIF_RSP_??? */
200-
};
201-
202187
DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
203-
struct blkif_common_response);
188+
struct blkif_response);
204189
DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
205-
struct blkif_x86_32_response);
190+
struct blkif_response __packed);
206191
DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
207-
struct blkif_x86_64_response);
192+
struct blkif_response);
208193

209194
union blkif_back_rings {
210195
struct blkif_back_ring native;

0 commit comments

Comments
 (0)