[Qemu-commits] [qemu/qemu] b0ac69: xen/disk: don't leak stack data via response ring

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: b0ac694fdb9113b973048ebe5619927e74965f61
      
https://github.com/qemu/qemu/commit/b0ac694fdb9113b973048ebe5619927e74965f61
  Author: Stefano Stabellini <address@hidden>
  Date:   2017-06-27 (Tue, 27 Jun 2017)

  Changed paths:
    M hw/block/xen_disk.c

  Log Message:
  -----------
  xen/disk: don't leak stack data via response ring

Rather than constructing a local structure instance on the stack, fill
the fields directly on the shared ring, just like other (Linux)
backends do. Build on the fact that all response structure flavors are
actually identical (aside from alignment and padding at the end).

This is XSA-216.

Reported by: Anthony Perard <address@hidden>
Signed-off-by: Jan Beulich <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
Acked-by: Anthony PERARD <address@hidden>


  Commit: 976eba1c88420c08977eae912628d443c4aacb0c
      
https://github.com/qemu/qemu/commit/976eba1c88420c08977eae912628d443c4aacb0c
  Author: Paul Durrant <address@hidden>
  Date:   2017-06-27 (Tue, 27 Jun 2017)

  Changed paths:
    M hw/block/xen_disk.c

  Log Message:
  -----------
  xen-disk: only advertize feature-persistent if grant copy is not available

If grant copy is available then it will always be used in preference to
persistent maps. In this case feature-persistent should not be advertized
to the frontend, otherwise it may needlessly copy data into persistently
granted buffers.

Signed-off-by: Paul Durrant <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>


  Commit: 3284fad7283596033cb810b4788fd1bb43312dbd
      
https://github.com/qemu/qemu/commit/3284fad7283596033cb810b4788fd1bb43312dbd
  Author: Paul Durrant <address@hidden>
  Date:   2017-06-27 (Tue, 27 Jun 2017)

  Changed paths:
    M hw/block/xen_disk.c

  Log Message:
  -----------
  xen-disk: add support for multi-page shared rings

The blkif protocol has had provision for negotiation of multi-page shared
rings for some time now and many guest OS have support in their frontend
drivers.

This patch makes the necessary modifications to xen-disk support a shared
ring up to order 4 (i.e. 16 pages).

Signed-off-by: Paul Durrant <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>


  Commit: 464588675455afda2899e20a0b120e4075de50c7
      
https://github.com/qemu/qemu/commit/464588675455afda2899e20a0b120e4075de50c7
  Author: Peter Maydell <address@hidden>
  Date:   2017-06-29 (Thu, 29 Jun 2017)

  Changed paths:
    M hw/block/xen_disk.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20170627-tag' into 
staging

Xen 2017/06/27

# gpg: Signature made Tue 27 Jun 2017 23:02:43 BST
# gpg:                using RSA key 0x894F8F4870E1AE90
# gpg: Good signature from "Stefano Stabellini <address@hidden>"
# gpg:                 aka "Stefano Stabellini <address@hidden>"
# Primary key fingerprint: D04E 33AB A51F 67BA 07D3  0AEA 894F 8F48 70E1 AE90

* remotes/sstabellini/tags/xen-20170627-tag:
  xen-disk: add support for multi-page shared rings
  xen-disk: only advertize feature-persistent if grant copy is not available
  xen/disk: don't leak stack data via response ring

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/82991bed7387...464588675455