Roger Pau Monné 1877914910 xen-blkback: read from indirect descriptors only once ... Since indirect descriptors are in memory shared with the frontend, the frontend could alter the first_sect and last_sect values after they have been validated but before they are recorded in the request. This may result in I/O requests that overflow the foreign page, possibly overwriting local pages when the I/O request is executed. When parsing indirect descriptors, only read first_sect and last_sect once. This is part of XSA155. CC: stable@vger.kernel.org Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Signed-off-by: David Vrabel <david.vrabel@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>		2015-12-18 10:00:37 -05:00
..
aoe	Revert "block: remove artifical max_hw_sectors cap"	2015-08-18 13:21:13 -07:00
drbd	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
mtip32xx	mtip32x: fix regression introduced by blk-mq per-hctx flush	2015-08-25 14:35:51 -06:00
paride	Char/Misc driver patches for 4.2-rc1	2015-06-26 14:51:15 -07:00
rsxx	block: make generic_make_request handle arbitrarily sized bios	2015-08-13 12:31:33 -06:00
xen-blkback	xen-blkback: read from indirect descriptors only once	2015-12-18 10:00:37 -05:00
zram	zram: fix possible use after free in zcomp_create()	2015-09-17 21:16:07 -07:00
amiflop.c
ataflop.c
brd.c	libnvdimm for 4.3:	2015-09-08 14:35:59 -07:00
cciss_cmd.h
cciss_scsi.c	scsi: Do not set cmd_per_lun to 1 in the host template	2015-05-31 18:06:28 -07:00
cciss_scsi.h
cciss.c	cciss: correct the non-resettable board list	2015-05-31 11:14:34 -07:00
cciss.h
cpqarray.c	genirq: Remove the deprecated 'IRQF_DISABLED' request_irq() flag entirely	2015-03-05 20:53:06 +01:00
cpqarray.h
cryptoloop.c
DAC960.c
DAC960.h
floppy.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
hd.c
ida_cmd.h
ida_ioctl.h
Kconfig	libnvdimm, pmem: move pmem to drivers/nvdimm/	2015-06-24 21:24:10 -04:00
loop.c	blk-mq: fix racy updates of rq->errors	2015-10-01 10:10:55 +02:00
loop.h	block: loop: don't hold lo_ctl_mutex in lo_open	2015-05-20 09:06:09 -06:00
Makefile	libnvdimm, pmem: move pmem to drivers/nvdimm/	2015-06-24 21:24:10 -04:00
mg_disk.c
nbd.c	nbd: flags is a u32 variable	2015-08-17 08:23:01 -06:00
null_blk.c	blk-mq: fix racy updates of rq->errors	2015-10-01 10:10:55 +02:00
nvme-core.c	blk-mq: fix racy updates of rq->errors	2015-10-01 10:10:55 +02:00
nvme-scsi.c	Merge branch 'for-4.2/drivers' of git://git.kernel.dk/linux-block	2015-06-25 15:12:50 -07:00
osdblk.c	block: support different tag allocation policy	2015-01-23 14:15:46 -07:00
pktcdvd.c	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
ps3disk.c
ps3vram.c	block: make generic_make_request handle arbitrarily sized bios	2015-08-13 12:31:33 -06:00
rbd_types.h
rbd.c	rbd: use writefull op for object size writes	2015-10-16 16:49:01 +02:00
skd_main.c	block: have drivers use blk_queue_max_discard_sectors()	2015-07-17 08:41:53 -06:00
skd_s1120.h
smart1,2.h
sunvdc.c
swim3.c	powerpc: Move Power Macintosh drivers to generic byteswappers	2015-03-23 14:29:40 +11:00
swim_asm.S
swim.c
sx8.c	block: rename REQ_TYPE_SPECIAL to REQ_TYPE_DRV_PRIV	2015-05-05 13:40:03 -06:00
umem.c	block: make generic_make_request handle arbitrarily sized bios	2015-08-13 12:31:33 -06:00
umem.h
virtio_blk.c	blk-mq: fix racy updates of rq->errors	2015-10-01 10:10:55 +02:00
xen-blkfront.c	xen/xenbus: Rename *RING_PAGE* to *RING_GRANT*	2015-10-23 14:20:46 +01:00
xsysace.c
z2ram.c