evtchn/FIFO: re-order and synchronize (with) map_control_block()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:46:37 +0000 (13:46 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:46:37 +0000 (13:46 +0100)
commitc5e63651fdc706954d920a2d98f74f4a21b46a7e
treec623388e2d8e5e9a94d1f18112ab4ca5388d68f7
parentdc8b01affd7f6f36d34c3854f51df0847df3ec0e
evtchn/FIFO: re-order and synchronize (with) map_control_block()

For evtchn_fifo_set_pending()'s check of the control block having been
set to be effective, ordering of respective reads and writes needs to be
ensured: The control block pointer needs to be recorded strictly after
the setting of all the queue heads, and it needs checking strictly
before any uses of them (this latter aspect was already guaranteed).

This is XSA-358 / CVE-2020-29570.

Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com>
xen/common/event_fifo.c