xen/blkif: Avoid double access to src->nr_segments
src is stored in shared memory and src->nr_segments is dereferenced twice at the end of the function. If a compiler decides to compile this into two separate memory accesses then the size limitation could be bypassed. Fix it by removing the double access to src->nr_segments. This is part of XSA-155. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
This commit is contained in:
parent
18f49881cf
commit
f9e98e5d7a
|
@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque
|
|||
d->nr_sectors = s->nr_sectors;
|
||||
return;
|
||||
}
|
||||
if (n > src->nr_segments)
|
||||
n = src->nr_segments;
|
||||
/* prevent the compiler from optimizing the code and using src->nr_segments instead */
|
||||
barrier();
|
||||
if (n > dst->nr_segments)
|
||||
n = dst->nr_segments;
|
||||
for (i = 0; i < n; i++)
|
||||
dst->seg[i] = src->seg[i];
|
||||
}
|
||||
|
@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque
|
|||
d->nr_sectors = s->nr_sectors;
|
||||
return;
|
||||
}
|
||||
if (n > src->nr_segments)
|
||||
n = src->nr_segments;
|
||||
/* prevent the compiler from optimizing the code and using src->nr_segments instead */
|
||||
barrier();
|
||||
if (n > dst->nr_segments)
|
||||
n = dst->nr_segments;
|
||||
for (i = 0; i < n; i++)
|
||||
dst->seg[i] = src->seg[i];
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue