diff options
| author | Stefano Stabellini <stefano.stabellini@eu.citrix.com> | 2015-12-18 15:09:58 +0000 |
|---|---|---|
| committer | Stefano Stabellini <stefano.stabellini@eu.citrix.com> | 2015-12-18 15:09:58 +0000 |
| commit | f9e98e5d7a67367b862941e339a98b8322fa0cea (patch) | |
| tree | 8139588be82cb11f0f6d0720833d577db7b57f07 /hw | |
| parent | 18f49881cf8359e89396aac12f5d3cf3f8a632ba (diff) | |
| download | qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.zip qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.tar.gz qemu-f9e98e5d7a67367b862941e339a98b8322fa0cea.tar.bz2 | |
xen/blkif: Avoid double access to src->nr_segments
src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function. If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.
Fix it by removing the double access to src->nr_segments.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/block/xen_blkif.h | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/hw/block/xen_blkif.h b/hw/block/xen_blkif.h index 711b692..c68487cb 100644 --- a/hw/block/xen_blkif.h +++ b/hw/block/xen_blkif.h @@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque d->nr_sectors = s->nr_sectors; return; } - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + barrier(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } @@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque d->nr_sectors = s->nr_sectors; return; } - if (n > src->nr_segments) - n = src->nr_segments; + /* prevent the compiler from optimizing the code and using src->nr_segments instead */ + barrier(); + if (n > dst->nr_segments) + n = dst->nr_segments; for (i = 0; i < n; i++) dst->seg[i] = src->seg[i]; } |