x86/hvmloader: avoid data corruption with xenstore reads/writes
authorAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 7 Jul 2015 12:39:27 +0000 (14:39 +0200)
committerJan Beulich <jbeulich@suse.com>
Tue, 7 Jul 2015 12:39:27 +0000 (14:39 +0200)
commitbbbe7e7157a964c485fb861765be291734676932
tree39bb620e605fd334e488bb1f35dfab8eea8daae5
parent02ea5031825d984d52eb9a982b8457e3434137f0
x86/hvmloader: avoid data corruption with xenstore reads/writes

The functions ring_read and ring_write() have logic to try and deal with
partial reads and writes.

However, in all cases where the "while (len)" loop executed twice, data
corruption would occur as the second memcpy() starts from the beginning of
"data" again, rather than from where it got to.

This bug manifested itself as protocol corruption when a reply header crossed
the first wrap of the response ring.  However, similar corruption would also
occur if hvmloader observed xenstored performing partial writes of the block
in question, or if hvmloader had to wait for xenstored to make space in either
ring.

Reported-by: Adam Kucia <djexit@o2.pl>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
tools/firmware/hvmloader/xenbus.c