evtchn/FIFO: add 2nd smp_rmb() to evtchn_fifo_word_from_port()
authorJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:42:51 +0000 (13:42 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 15 Dec 2020 12:42:51 +0000 (13:42 +0100)
commitdc8b01affd7f6f36d34c3854f51df0847df3ec0e
tree1c1a1be7220e5a003839c01c37f588840c1d7fcd
parentca85682e8c16361fdf3814c9b25a2ec3ff4f8bed
evtchn/FIFO: add 2nd smp_rmb() to evtchn_fifo_word_from_port()

Besides with add_page_to_event_array() the function also needs to
synchronize with evtchn_fifo_init_control() setting both d->evtchn_fifo
and (subsequently) d->evtchn_port_ops.

This is XSA-359 / CVE-2020-29571.

Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
xen/common/event_fifo.c