xen-blkback: don't leak stack data via response ring
authorJan Beulich <jbeulich@suse.com>
Tue, 13 Jun 2017 20:28:27 +0000 (16:28 -0400)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 18 Jul 2017 17:38:44 +0000 (18:38 +0100)
commitcc21fe1ff77acfab555df5577ea46fc89932f3b2
tree98b82ed4f394d1a11f36b85c545befae87e29cf5
parentb8f254aa17f720053054c4ecff3920973a83b9d6
xen-blkback: don't leak stack data via response ring

commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341 upstream.

Rather than constructing a local structure instance on the stack, fill
the fields directly on the shared ring, just like other backends do.
Build on the fact that all response structure flavors are actually
identical (the old code did make this assumption too).

This is XSA-216.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/block/xen-blkback/blkback.c
drivers/block/xen-blkback/common.h