From: Ian Campbell Date: Fri, 15 Feb 2013 09:24:43 +0000 (+0000) Subject: tools/ocaml: oxenstored: correctly handle a full ring. X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~7288 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=eeddfad1b339dcaa787230f519a19de1cbc22ad8;p=xen.git tools/ocaml: oxenstored: correctly handle a full ring. Change 26521:2c0fd406f02c (part of XSA-38 / CVE-2013-0215) incorrectly caused us to ignore rather than process a completely full ring. Check if producer and consumer are equal before masking to avoid this, since prod == cons + PAGE_SIZE after masking becomes prod == cons. Signed-off-by: Ian Campbell Acked-by: Keir Fraser Committed-by: Ian Campbell --- diff --git a/tools/ocaml/libs/xb/xs_ring_stubs.c b/tools/ocaml/libs/xb/xs_ring_stubs.c index 4888ac5631..fdd9983d1a 100644 --- a/tools/ocaml/libs/xb/xs_ring_stubs.c +++ b/tools/ocaml/libs/xb/xs_ring_stubs.c @@ -45,10 +45,10 @@ static int xs_ring_read(struct mmap_interface *interface, cons = *(volatile uint32*)&intf->req_cons; prod = *(volatile uint32*)&intf->req_prod; xen_mb(); - cons = MASK_XENSTORE_IDX(cons); - prod = MASK_XENSTORE_IDX(prod); if (prod == cons) return 0; + cons = MASK_XENSTORE_IDX(cons); + prod = MASK_XENSTORE_IDX(prod); if (prod > cons) to_read = prod - cons; else