File xsa359.patch of Package xen.25148
evtchn/FIFO: add 2nd smp_rmb() to evtchn_fifo_word_from_port()
Besides with add_page_to_event_array() the function also needs to
synchronize with evtchn_fifo_init_control() setting both d->evtchn_fifo
and (subsequently) d->evtchn_port_ops.
This is XSA-359.
Reported-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
--- a/xen/common/event_fifo.c
+++ b/xen/common/event_fifo.c
@@ -34,6 +34,13 @@ static inline event_word_t *evtchn_fifo_
{
unsigned int p, w;
+ /*
+ * Callers aren't required to hold d->event_lock, so we need to synchronize
+ * with evtchn_fifo_init_control() setting d->evtchn_port_ops /after/
+ * d->evtchn_fifo.
+ */
+ smp_rmb();
+
if ( unlikely(port >= d->evtchn_fifo->num_evtchns) )
return NULL;
@@ -590,6 +597,10 @@ int evtchn_fifo_init_control(struct evtc
if ( rc < 0 )
goto error;
+ /*
+ * This call, as a side effect, synchronizes with
+ * evtchn_fifo_word_from_port().
+ */
rc = map_control_block(v, gfn, offset);
if ( rc < 0 )
goto error;