evtchn/FIFO: re-order and synchronize (with) map_control_block()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 11:31:02 +0000 (12:31 +0100)
committerHans van Kranenburg <hans@knorrie.org>
Tue, 15 Dec 2020 11:31:02 +0000 (12:31 +0100)
commit149138574e7bd975af256cd119cd38d02f6cf9c6
treef7c3d5f916d303a11a42225d2479358d934bebc1
parent86432d1537345dcbbf63f27ef230be26ae75b700
evtchn/FIFO: re-order and synchronize (with) map_control_block()

For evtchn_fifo_set_pending()'s check of the control block having been
set to be effective, ordering of respective reads and writes needs to be
ensured: The control block pointer needs to be recorded strictly after
the setting of all the queue heads, and it needs checking strictly
before any uses of them (this latter aspect was already guaranteed).

This is XSA-358 / CVE-2020-29570.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com>
xen/common/event_fifo.c