evtchn/FIFO: re-order and synchronize (with) map_control_block()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 13:14:54 +0000 (14:14 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 13:14:54 +0000 (14:14 +0100)
commit9872981ddd8483190f5f634e289806ee047d3f5c
treeb31e4505f1e899db52dbd3df23c4b70c76d8c78b
parentd785e076b36111899ef9ee2340f2da9375afc9f5
evtchn/FIFO: re-order and synchronize (with) map_control_block()

For evtchn_fifo_set_pending()'s check of the control block having been
set to be effective, ordering of respective reads and writes needs to be
ensured: The control block pointer needs to be recorded strictly after
the setting of all the queue heads, and it needs checking strictly
before any uses of them (this latter aspect was already guaranteed).

This is XSA-358 / CVE-2020-29570.

Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com>
master commit: c5e63651fdc706954d920a2d98f74f4a21b46a7e
master date: 2020-12-15 13:46:37 +0100
xen/common/event_fifo.c