xen/blkfront: don't take local copy of a request from the ring page
authorJuergen Gross <jgross@suse.com>
Fri, 30 Jul 2021 10:38:53 +0000 (12:38 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 1 Dec 2021 08:19:09 +0000 (09:19 +0100)
commit8e147855fcf275f30dbc93e1a8f4031724e7ad13
treedabb9d104bbf5dcfdbb420a9cc56be3442ea5159
parent273f04d5d135c5a00f2b8666f51c2fe87b38bcb7
xen/blkfront: don't take local copy of a request from the ring page

commit 8f5a695d99000fc3aa73934d7ced33cfc64dcdab upstream.

In order to avoid a malicious backend being able to influence the local
copy of a request build the request locally first and then copy it to
the ring page instead of doing it the other way round as today.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Link: https://lore.kernel.org/r/20210730103854.12681-3-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/xen-blkfront.c