xen-blkback: don't leak stack data via response ring
authorJan Beulich <jbeulich@suse.com>
Tue, 13 Jun 2017 20:28:27 +0000 (16:28 -0400)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 23 Jul 2017 03:01:59 +0000 (03:01 +0000)
commita618fdfe153f0ae7a3d7607bb643601e44e64152
tree59004b6d003de82c0e4b83fbca623539b61f0293
parentf04c0a09b5c1ccc3ce7f5bd61d40e7802c778524
xen-blkback: don't leak stack data via response ring

commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341 upstream.

Rather than constructing a local structure instance on the stack, fill
the fields directly on the shared ring, just like other backends do.
Build on the fact that all response structure flavors are actually
identical (the old code did make this assumption too).

This is XSA-216.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/xen-blkback/blkback.c
drivers/block/xen-blkback/common.h