xen-blkback: don't leak stack data via response ring
authorJan Beulich <jbeulich@suse.com>
Tue, 13 Jun 2017 20:28:27 +0000 (16:28 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Jun 2017 11:00:27 +0000 (13:00 +0200)
commit4ae2cb91a6365a6472fad7f04785cc0420ea5ada
tree4754398bd727f68631397bc4dbdcc78d2b31aeae
parente5c49c1703ae906a8f41f58aabd5258a06fc9e6d
xen-blkback: don't leak stack data via response ring

commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341 upstream.

Rather than constructing a local structure instance on the stack, fill
the fields directly on the shared ring, just like other backends do.
Build on the fact that all response structure flavors are actually
identical (the old code did make this assumption too).

This is XSA-216.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/xen-blkback/blkback.c
drivers/block/xen-blkback/common.h