* [Qemu-devel] [PULL 0/2] xsa155
@ 2015-12-18 15:17 ` Stefano Stabellini
0 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
are available in the git repository at:
git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
It would be great if they were backported to the QEMU stable trees too.
----------------------------------------------------------------
XSA-155 fixes
----------------------------------------------------------------
Stefano Stabellini (2):
xen/blkif: Avoid double access to src->nr_segments
xenfb: avoid reading twice the same fields from the shared page
hw/block/xen_blkif.h | 12 ++++++++----
hw/display/xenfb.c | 10 ++++++----
2 files changed, 14 insertions(+), 8 deletions(-)
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PULL 0/2] xsa155
@ 2015-12-18 15:17 ` Stefano Stabellini
0 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
are available in the git repository at:
git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
It would be great if they were backported to the QEMU stable trees too.
----------------------------------------------------------------
XSA-155 fixes
----------------------------------------------------------------
Stefano Stabellini (2):
xen/blkif: Avoid double access to src->nr_segments
xenfb: avoid reading twice the same fields from the shared page
hw/block/xen_blkif.h | 12 ++++++++----
hw/display/xenfb.c | 10 ++++++----
2 files changed, 14 insertions(+), 8 deletions(-)
^ permalink raw reply [flat|nested] 10+ messages in thread
* [Qemu-devel] [PULL 1/2] xen/blkif: Avoid double access to src->nr_segments
2015-12-18 15:17 ` Stefano Stabellini
@ 2015-12-18 15:17 ` Stefano Stabellini
-1 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function. If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.
Fix it by removing the double access to src->nr_segments.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
hw/block/xen_blkif.h | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/hw/block/xen_blkif.h b/hw/block/xen_blkif.h
index 711b692..c68487cb 100644
--- a/hw/block/xen_blkif.h
+++ b/hw/block/xen_blkif.h
@@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque
d->nr_sectors = s->nr_sectors;
return;
}
- if (n > src->nr_segments)
- n = src->nr_segments;
+ /* prevent the compiler from optimizing the code and using src->nr_segments instead */
+ barrier();
+ if (n > dst->nr_segments)
+ n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
@@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque
d->nr_sectors = s->nr_sectors;
return;
}
- if (n > src->nr_segments)
- n = src->nr_segments;
+ /* prevent the compiler from optimizing the code and using src->nr_segments instead */
+ barrier();
+ if (n > dst->nr_segments)
+ n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PULL 1/2] xen/blkif: Avoid double access to src->nr_segments
@ 2015-12-18 15:17 ` Stefano Stabellini
0 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function. If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.
Fix it by removing the double access to src->nr_segments.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
hw/block/xen_blkif.h | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/hw/block/xen_blkif.h b/hw/block/xen_blkif.h
index 711b692..c68487cb 100644
--- a/hw/block/xen_blkif.h
+++ b/hw/block/xen_blkif.h
@@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque
d->nr_sectors = s->nr_sectors;
return;
}
- if (n > src->nr_segments)
- n = src->nr_segments;
+ /* prevent the compiler from optimizing the code and using src->nr_segments instead */
+ barrier();
+ if (n > dst->nr_segments)
+ n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
@@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque
d->nr_sectors = s->nr_sectors;
return;
}
- if (n > src->nr_segments)
- n = src->nr_segments;
+ /* prevent the compiler from optimizing the code and using src->nr_segments instead */
+ barrier();
+ if (n > dst->nr_segments)
+ n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [Qemu-devel] [PULL 2/2] xenfb: avoid reading twice the same fields from the shared page
2015-12-18 15:17 ` Stefano Stabellini
@ 2015-12-18 15:17 ` Stefano Stabellini
-1 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
Reading twice the same field could give the guest an attack of
opportunity. In the case of event->type, gcc could compile the switch
statement into a jump table, effectively ending up reading the type
field multiple times.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
hw/display/xenfb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 5e324ef..4e2a27a 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -784,18 +784,20 @@ static void xenfb_invalidate(void *opaque)
static void xenfb_handle_events(struct XenFB *xenfb)
{
- uint32_t prod, cons;
+ uint32_t prod, cons, out_cons;
struct xenfb_page *page = xenfb->c.page;
prod = page->out_prod;
- if (prod == page->out_cons)
+ out_cons = page->out_cons;
+ if (prod == out_cons)
return;
xen_rmb(); /* ensure we see ring contents up to prod */
- for (cons = page->out_cons; cons != prod; cons++) {
+ for (cons = out_cons; cons != prod; cons++) {
union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
+ uint8_t type = event->type;
int x, y, w, h;
- switch (event->type) {
+ switch (type) {
case XENFB_TYPE_UPDATE:
if (xenfb->up_count == UP_QUEUE)
xenfb->up_fullscreen = 1;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PULL 2/2] xenfb: avoid reading twice the same fields from the shared page
@ 2015-12-18 15:17 ` Stefano Stabellini
0 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:17 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-stable, xen-devel, qemu-devel, stefano.stabellini
Reading twice the same field could give the guest an attack of
opportunity. In the case of event->type, gcc could compile the switch
statement into a jump table, effectively ending up reading the type
field multiple times.
This is part of XSA-155.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
hw/display/xenfb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 5e324ef..4e2a27a 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -784,18 +784,20 @@ static void xenfb_invalidate(void *opaque)
static void xenfb_handle_events(struct XenFB *xenfb)
{
- uint32_t prod, cons;
+ uint32_t prod, cons, out_cons;
struct xenfb_page *page = xenfb->c.page;
prod = page->out_prod;
- if (prod == page->out_cons)
+ out_cons = page->out_cons;
+ if (prod == out_cons)
return;
xen_rmb(); /* ensure we see ring contents up to prod */
- for (cons = page->out_cons; cons != prod; cons++) {
+ for (cons = out_cons; cons != prod; cons++) {
union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
+ uint8_t type = event->type;
int x, y, w, h;
- switch (event->type) {
+ switch (type) {
case XENFB_TYPE_UPDATE:
if (xenfb->up_count == UP_QUEUE)
xenfb->up_fullscreen = 1;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [Qemu-devel] [PULL 0/2] xsa155
2015-12-18 15:17 ` Stefano Stabellini
@ 2015-12-18 15:33 ` Stefano Stabellini
-1 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:33 UTC (permalink / raw)
To: mdroth
Cc: peter.maydell, xen-devel, qemu-devel, stefano.stabellini, qemu-stable
Michael, could you please backport these two patches? They should apply
fine.
On Fri, 18 Dec 2015, Stefano Stabellini wrote:
> The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
>
> configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
>
> are available in the git repository at:
>
> git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
>
> for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
>
> xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
>
>
> It would be great if they were backported to the QEMU stable trees too.
>
>
> ----------------------------------------------------------------
> XSA-155 fixes
>
> ----------------------------------------------------------------
> Stefano Stabellini (2):
> xen/blkif: Avoid double access to src->nr_segments
> xenfb: avoid reading twice the same fields from the shared page
>
> hw/block/xen_blkif.h | 12 ++++++++----
> hw/display/xenfb.c | 10 ++++++----
> 2 files changed, 14 insertions(+), 8 deletions(-)
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PULL 0/2] xsa155
@ 2015-12-18 15:33 ` Stefano Stabellini
0 siblings, 0 replies; 10+ messages in thread
From: Stefano Stabellini @ 2015-12-18 15:33 UTC (permalink / raw)
To: mdroth
Cc: peter.maydell, xen-devel, qemu-devel, stefano.stabellini, qemu-stable
Michael, could you please backport these two patches? They should apply
fine.
On Fri, 18 Dec 2015, Stefano Stabellini wrote:
> The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
>
> configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
>
> are available in the git repository at:
>
> git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
>
> for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
>
> xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
>
>
> It would be great if they were backported to the QEMU stable trees too.
>
>
> ----------------------------------------------------------------
> XSA-155 fixes
>
> ----------------------------------------------------------------
> Stefano Stabellini (2):
> xen/blkif: Avoid double access to src->nr_segments
> xenfb: avoid reading twice the same fields from the shared page
>
> hw/block/xen_blkif.h | 12 ++++++++----
> hw/display/xenfb.c | 10 ++++++----
> 2 files changed, 14 insertions(+), 8 deletions(-)
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Qemu-devel] [PULL 0/2] xsa155
2015-12-18 15:17 ` Stefano Stabellini
@ 2015-12-18 16:04 ` Peter Maydell
-1 siblings, 0 replies; 10+ messages in thread
From: Peter Maydell @ 2015-12-18 16:04 UTC (permalink / raw)
To: Stefano Stabellini
Cc: xen-devel@lists.xensource.com Devel, QEMU Developers, qemu-stable
On 18 December 2015 at 15:17, Stefano Stabellini
<stefano.stabellini@eu.citrix.com> wrote:
> The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
>
> configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
>
> are available in the git repository at:
>
> git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
>
> for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
>
> xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
>
>
> It would be great if they were backported to the QEMU stable trees too.
>
>
> ----------------------------------------------------------------
> XSA-155 fixes
>
> ----------------------------------------------------------------
> Stefano Stabellini (2):
> xen/blkif: Avoid double access to src->nr_segments
> xenfb: avoid reading twice the same fields from the shared page
Applied, thanks.
-- PMM
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PULL 0/2] xsa155
@ 2015-12-18 16:04 ` Peter Maydell
0 siblings, 0 replies; 10+ messages in thread
From: Peter Maydell @ 2015-12-18 16:04 UTC (permalink / raw)
To: Stefano Stabellini
Cc: xen-devel@lists.xensource.com Devel, QEMU Developers, qemu-stable
On 18 December 2015 at 15:17, Stefano Stabellini
<stefano.stabellini@eu.citrix.com> wrote:
> The following changes since commit 18f49881cf8359e89396aac12f5d3cf3f8a632ba:
>
> configure: Fix shell syntax to placate OpenBSD's pdksh (2015-12-18 13:32:49 +0000)
>
> are available in the git repository at:
>
> git://xenbits.xen.org/people/sstabellini/qemu-dm.git tags/xsa155
>
> for you to fetch changes up to 7ea11bf376aea4bf8340eb363de9777c7f93e556:
>
> xenfb: avoid reading twice the same fields from the shared page (2015-12-18 15:10:09 +0000)
>
>
> It would be great if they were backported to the QEMU stable trees too.
>
>
> ----------------------------------------------------------------
> XSA-155 fixes
>
> ----------------------------------------------------------------
> Stefano Stabellini (2):
> xen/blkif: Avoid double access to src->nr_segments
> xenfb: avoid reading twice the same fields from the shared page
Applied, thanks.
-- PMM
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2015-12-18 16:04 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-18 15:17 [Qemu-devel] [PULL 0/2] xsa155 Stefano Stabellini
2015-12-18 15:17 ` Stefano Stabellini
2015-12-18 15:17 ` [Qemu-devel] [PULL 1/2] xen/blkif: Avoid double access to src->nr_segments Stefano Stabellini
2015-12-18 15:17 ` Stefano Stabellini
2015-12-18 15:17 ` [Qemu-devel] [PULL 2/2] xenfb: avoid reading twice the same fields from the shared page Stefano Stabellini
2015-12-18 15:17 ` Stefano Stabellini
2015-12-18 15:33 ` [Qemu-devel] [PULL 0/2] xsa155 Stefano Stabellini
2015-12-18 15:33 ` Stefano Stabellini
2015-12-18 16:04 ` [Qemu-devel] " Peter Maydell
2015-12-18 16:04 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.