From: Roger Pau Monné <roger.pau@citrix.com>
Date: Tue, 3 Nov 2015 16:40:43 +0000 (+0000)
Subject: xen-blkback: read from indirect descriptors only once
X-Git-Tag: v4.1.12-92~172^2
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=b42e493263d80ef54c2e4c06276b9520211ab121;p=users%2Fjedix%2Flinux-maple.git

xen-blkback: read from indirect descriptors only once

Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request.  This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.

When parsing indirect descriptors, only read first_sect and last_sect
once.

This is part of XSA155.

(cherry-pick from 18779149101c0dd43ded43669ae2a92d21b6f9cb)
CC: stable@vger.kernel.org
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
----
v2: This is against v4.3
---