[Xen-changelog] [xen stable-4.2] tools/ocaml: oxenstored: correctly handle a full ring.

[patchbot@xxxxxxx]

commit 762349de68bcb832b8b6fb5357b837789506f242
Author:     Ian Campbell <ian.campbell@xxxxxxxxxx>
AuthorDate: Fri Feb 15 11:50:22 2013 +0000
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Fri Feb 15 11:50:22 2013 +0000

    tools/ocaml: oxenstored: correctly handle a full ring.
    
    Change 26521:2c0fd406f02c (part of XSA-38 / CVE-2013-0215) incorrectly
    caused us to ignore rather than process a completely full ring. Check if
    producer and consumer are equal before masking to avoid this, since prod ==
    cons + PAGE_SIZE after masking becomes prod == cons.
    
    Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    Acked-by: Keir Fraser <keir@xxxxxxx>
    Committed-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
    
    xen-unstable changeset: 26539:759574df84a6
    Backport-requested-by: security@xxxxxxx
    Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---
 tools/ocaml/libs/xb/xs_ring_stubs.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/ocaml/libs/xb/xs_ring_stubs.c 
b/tools/ocaml/libs/xb/xs_ring_stubs.c
index 4888ac5..fdd9983 100644
--- a/tools/ocaml/libs/xb/xs_ring_stubs.c
+++ b/tools/ocaml/libs/xb/xs_ring_stubs.c
@@ -45,10 +45,10 @@ static int xs_ring_read(struct mmap_interface *interface,
        cons = *(volatile uint32*)&intf->req_cons;
        prod = *(volatile uint32*)&intf->req_prod;
        xen_mb();
-       cons = MASK_XENSTORE_IDX(cons);
-       prod = MASK_XENSTORE_IDX(prod);
        if (prod == cons)
                return 0;
+       cons = MASK_XENSTORE_IDX(cons);
+       prod = MASK_XENSTORE_IDX(prod);
        if (prod > cons)
                to_read = prod - cons;
        else
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.2

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog