[Xen-changelog] [xen-4.1-testing] tools/ocaml: oxenstored: correctly handle a full ring.

[Xen patchbot-4.1-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Ian Campbell <ian.campbell@xxxxxxxxxx>
# Date 1360929045 0
# Node ID 8792a805cc9a7f1a6846d6464a84366b68d83f73
# Parent  de71e57ea21b9b6796e1c4ef2b3c38961b104b24
tools/ocaml: oxenstored: correctly handle a full ring.

Change 26521:2c0fd406f02c (part of XSA-38 / CVE-2013-0215) incorrectly
caused us to ignore rather than process a completely full ring. Check if
producer and consumer are equal before masking to avoid this, since prod ==
cons + PAGE_SIZE after masking becomes prod == cons.

Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Acked-by: Keir Fraser <keir@xxxxxxx>
Committed-by: Ian Campbell <ian.campbell@xxxxxxxxxx>

xen-unstable changeset: 26539:759574df84a6
Backport-requested-by: security@xxxxxxx
Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---


diff -r de71e57ea21b -r 8792a805cc9a tools/ocaml/libs/xb/xs_ring_stubs.c
--- a/tools/ocaml/libs/xb/xs_ring_stubs.c       Thu Feb 14 14:26:03 2013 +0100
+++ b/tools/ocaml/libs/xb/xs_ring_stubs.c       Fri Feb 15 11:50:45 2013 +0000
@@ -49,10 +49,10 @@ static int xs_ring_read(struct mmap_inte
        cons = *(volatile uint32*)&intf->req_cons;
        prod = *(volatile uint32*)&intf->req_prod;
        xen_mb();
+       if (prod == cons)
+               return 0;
        cons = MASK_XENSTORE_IDX(cons);
        prod = MASK_XENSTORE_IDX(prod);
-       if (prod == cons)
-               return 0;
        if (prod > cons)
                to_read = prod - cons;
        else

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog