git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
xen-blkback: don't leak stack data via response ring
[pandora-kernel.git]
/
drivers
/
block
/
xen-blkback
/
common.h
diff --git
a/drivers/block/xen-blkback/common.h
b/drivers/block/xen-blkback/common.h
index
dfb1b3a
..
4a5f21e
100644
(file)
--- a/
drivers/block/xen-blkback/common.h
+++ b/
drivers/block/xen-blkback/common.h
@@
-56,9
+56,6
@@
struct blkif_common_request {
char dummy;
};
struct blkif_common_request {
char dummy;
};
-struct blkif_common_response {
- char dummy;
-};
/* i386 protocol version */
#pragma pack(push, 4)
/* i386 protocol version */
#pragma pack(push, 4)
@@
-83,11
+80,6
@@
struct blkif_x86_32_request {
struct blkif_x86_32_request_discard discard;
} u;
};
struct blkif_x86_32_request_discard discard;
} u;
};
-struct blkif_x86_32_response {
- uint64_t id; /* copied from request */
- uint8_t operation; /* copied from request */
- int16_t status; /* BLKIF_RSP_??? */
-};
#pragma pack(pop)
/* x86_64 protocol version */
#pragma pack(pop)
/* x86_64 protocol version */
@@
-112,18
+104,13
@@
struct blkif_x86_64_request {
struct blkif_x86_64_request_discard discard;
} u;
};
struct blkif_x86_64_request_discard discard;
} u;
};
-struct blkif_x86_64_response {
- uint64_t __attribute__((__aligned__(8))) id;
- uint8_t operation; /* copied from request */
- int16_t status; /* BLKIF_RSP_??? */
-};
DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
- struct blkif_
common_
response);
+ struct blkif_response);
DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
- struct blkif_
x86_32_response
);
+ struct blkif_
response __packed
);
DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
- struct blkif_
x86_64_
response);
+ struct blkif_response);
union blkif_back_rings {
struct blkif_back_ring native;
union blkif_back_rings {
struct blkif_back_ring native;
@@
-198,6
+185,8
@@
struct xen_blkif {
int st_wr_sect;
wait_queue_head_t waiting_to_free;
int st_wr_sect;
wait_queue_head_t waiting_to_free;
+ /* Thread shutdown wait queue. */
+ wait_queue_head_t shutdown_wq;
};
};
@@
-236,11
+225,11
@@
static inline void blkif_get_x86_32_req(struct blkif_request *dst,
struct blkif_x86_32_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
struct blkif_x86_32_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
- dst->operation =
src->operation
;
+ dst->operation =
ACCESS_ONCE(src->operation)
;
dst->nr_segments = src->nr_segments;
dst->handle = src->handle;
dst->id = src->id;
dst->nr_segments = src->nr_segments;
dst->handle = src->handle;
dst->id = src->id;
- switch (
src
->operation) {
+ switch (
dst
->operation) {
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER:
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER:
@@
-265,11
+254,11
@@
static inline void blkif_get_x86_64_req(struct blkif_request *dst,
struct blkif_x86_64_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
struct blkif_x86_64_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
- dst->operation =
src->operation
;
+ dst->operation =
ACCESS_ONCE(src->operation)
;
dst->nr_segments = src->nr_segments;
dst->handle = src->handle;
dst->id = src->id;
dst->nr_segments = src->nr_segments;
dst->handle = src->handle;
dst->id = src->id;
- switch (
src
->operation) {
+ switch (
dst
->operation) {
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER:
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER: