• Dongli Zhang's avatar
    xen/blkback: rework connect_ring() to avoid inconsistent xenstore... · 4a8c31a1
    Dongli Zhang authored
    xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront
    
    The xenstore 'ring-page-order' is used globally for each blkback queue and
    therefore should be read from xenstore only once. However, it is obtained
    in read_per_ring_refs() which might be called multiple times during the
    initialization of each blkback queue.
    
    If the blkfront is malicious and the 'ring-page-order' is set in different
    value by blkfront every time before blkback reads it, this may end up at
    the "WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));" in
    xen_blkif_disconnect() when frontend is destroyed.
    
    This patch reworks connect_ring() to read xenstore 'ring-page-order' only
    once.
    Signed-off-by: default avatarDongli Zhang <dongli.zhang@oracle.com>
    Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    4a8c31a1
xenbus.c 28 KB