[Xen-changelog] [xen stable-4.6] x86/HVM: avoid reading ioreq state more than once

[patchbot@xxxxxxx]

commit 33708eee8f6a1ac4f4f92317e5d0c412761d2fbb
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Dec 17 14:27:25 2015 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Dec 17 14:27:25 2015 +0100

    x86/HVM: avoid reading ioreq state more than once
    
    Otherwise, especially when the compiler chooses to translate the
    switch() to a jump table, unpredictable behavior (and in the jump table
    case arbitrary code execution) can result.
    
    This is XSA-166.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    master commit: b452430a4cdfc801fa4bc391aed7522365e1deb6
    master date: 2015-12-17 14:22:46 +0100
---
 xen/arch/x86/hvm/hvm.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 615fa89..186e01e 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -448,7 +448,10 @@ static bool_t hvm_wait_for_io(struct hvm_ioreq_vcpu *sv, 
ioreq_t *p)
 {
     while ( sv->pending )
     {
-        switch ( p->state )
+        unsigned int state = p->state;
+
+        rmb();
+        switch ( state )
         {
         case STATE_IOREQ_NONE:
             /*
@@ -459,18 +462,15 @@ static bool_t hvm_wait_for_io(struct hvm_ioreq_vcpu *sv, 
ioreq_t *p)
             hvm_io_assist(sv, ~0ul);
             break;
         case STATE_IORESP_READY: /* IORESP_READY -> NONE */
-            rmb(); /* see IORESP_READY /then/ read contents of ioreq */
             p->state = STATE_IOREQ_NONE;
             hvm_io_assist(sv, p->data);
             break;
         case STATE_IOREQ_READY:  /* IOREQ_{READY,INPROCESS} -> IORESP_READY */
         case STATE_IOREQ_INPROCESS:
-            wait_on_xen_event_channel(sv->ioreq_evtchn,
-                                      (p->state != STATE_IOREQ_READY) &&
-                                      (p->state != STATE_IOREQ_INPROCESS));
+            wait_on_xen_event_channel(sv->ioreq_evtchn, p->state != state);
             break;
         default:
-            gdprintk(XENLOG_ERR, "Weird HVM iorequest state %d.\n", p->state);
+            gdprintk(XENLOG_ERR, "Weird HVM iorequest state %u\n", state);
             sv->pending = 0;
             domain_crash(sv->vcpu->domain);
             return 0; /* bail */
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog