xen/blkfront: don't take local copy of a request from the ring page
authorJuergen Gross <jgross@suse.com>
Mon, 29 Nov 2021 12:11:11 +0000 (13:11 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Dec 2021 07:45:04 +0000 (08:45 +0100)
commitf5aa58413914690503cd390483df4c040b1e294f
tree51baed1118c843c8037c9cd9fdeaab48e563a733
parent496e5d5772661e5e4c7c2f5943b7bc0bb0bdea59
xen/blkfront: don't take local copy of a request from the ring page

commit 8f5a695d99000fc3aa73934d7ced33cfc64dcdab upstream.

In order to avoid a malicious backend being able to influence the local
copy of a request build the request locally first and then copy it to
the ring page instead of doing it the other way round as today.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Link: https://lore.kernel.org/r/20210730103854.12681-3-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/xen-blkfront.c