[Xen-changelog] [xen-unstable] [BLOCK] blkback: Copy shared data before verification

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Node ID f326ec66e5149c0140a671fe47e4a75437897d7a
# Parent  da5997fcc0702c8e31fa4d8fcd034c5a9cb3ab8d
[BLOCK] blkback: Copy shared data before verification

As it is blkback verifies the metadata from the frontend in place.
This means we run the risk of the frontend changing the data after
we've verified it.  This patch copies the data onto the stack before
verifying and using it to ensure we see a consistent snapshot.

Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
---
 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c |   14 +++++++-------
 1 files changed, 7 insertions(+), 7 deletions(-)

diff -r da5997fcc070 -r f326ec66e514 
linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Mon Oct 23 
09:57:24 2006 +0100
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Mon Oct 23 
10:00:14 2006 +0100
@@ -293,7 +293,7 @@ static int do_block_io_op(blkif_t *blkif
 static int do_block_io_op(blkif_t *blkif)
 {
        blkif_back_ring_t *blk_ring = &blkif->blk_ring;
-       blkif_request_t *req;
+       blkif_request_t req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -311,22 +311,22 @@ static int do_block_io_op(blkif_t *blkif
                        break;
                }
 
-               req = RING_GET_REQUEST(blk_ring, rc);
+               memcpy(&req, RING_GET_REQUEST(blk_ring, rc), sizeof(req));
                blk_ring->req_cons = ++rc; /* before make_response() */
 
-               switch (req->operation) {
+               switch (req.operation) {
                case BLKIF_OP_READ:
                        blkif->st_rd_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                case BLKIF_OP_WRITE:
                        blkif->st_wr_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                default:
                        DPRINTK("error: unknown block io operation [%d]\n",
-                               req->operation);
-                       make_response(blkif, req->id, req->operation,
+                               req.operation);
+                       make_response(blkif, req.id, req.operation,
                                      BLKIF_RSP_ERROR);
                        free_req(pending_req);
                        break;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog