On 02.02.21 18:56, Paul Durrant wrote: > From: Paul Durrant > > Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid > inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the > behaviour of xen-blkback when connecting to a frontend was: > > - read 'ring-page-order' > - if not present then expect a single page ring specified by 'ring-ref' > - else expect a ring specified by 'ring-refX' where X is between 0 and > 1 << ring-page-order > > This was correct behaviour, but was broken by the afforementioned commit to > become: > > - read 'ring-page-order' > - if not present then expect a single page ring (i.e. ring-page-order = 0) > - expect a ring specified by 'ring-refX' where X is between 0 and > 1 << ring-page-order > - if that didn't work then see if there's a single page ring specified by > 'ring-ref' > > This incorrect behaviour works most of the time but fails when a frontend > that sets 'ring-page-order' is unloaded and replaced by one that does not > because, instead of reading 'ring-ref', xen-blkback will read the stale > 'ring-ref0' left around by the previous frontend will try to map the wrong > grant reference. > > This patch restores the original behaviour. > > Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront") > Signed-off-by: Paul Durrant > Reviewed-by: Dongli Zhang > Reviewed-by: "Roger Pau Monné" Pushed to xen/tip.git for-linus-5.13 Juergen