[src/netbsd-6-1]: src/doc 1358

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1ef3e4ec4dd6
branches:  netbsd-6-1
changeset: 776113:1ef3e4ec4dd6
user:      snj <snj%NetBSD.org@localhost>
date:      Fri Jan 08 21:25:54 2016 +0000

description:
1358

diffstat:

 doc/CHANGES-6.1.6 |  19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diffs (30 lines):

diff -r 42d8396a0d36 -r 1ef3e4ec4dd6 doc/CHANGES-6.1.6
--- a/doc/CHANGES-6.1.6 Fri Jan 08 21:25:28 2016 +0000
+++ b/doc/CHANGES-6.1.6 Fri Jan 08 21:25:54 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-6.1.6,v 1.1.2.54 2015/11/18 07:44:37 msaitoh Exp $
+# $NetBSD: CHANGES-6.1.6,v 1.1.2.55 2016/01/08 21:25:54 snj Exp $
 
 A complete list of changes from the NetBSD 6.1.5 release to the NetBSD 6.1.6
 release:
@@ -6818,3 +6818,20 @@
        Fix panic after "ifconfig gifX tunnel src dst" failed because of
        duplicate pair address.
        [knakahara, ticket #1345]
+
+sys/arch/xen/include/xen-public/io/ring.h      1.3 via patch
+sys/arch/xen/xen/pciback.c                     1.10 via patch
+sys/arch/xen/xen/xbdback_xenbus.c              1.62 via patch
+sys/arch/xen/xen/xennetback_xenbus.c           1.54 via patch
+
+       Apply patch from xsa155: make sure that the backend won't read
+       parts of the request again (possibly because of compiler
+       optimisations), by using copies and barrier.
+       From XSA155:
+       The compiler can emit optimizations in the PV backend drivers
+       which can lead to double fetch vulnerabilities. Specifically
+       the shared memory between the frontend and backend can be fetched
+       twice (during which time the frontend can alter the contents)
+       possibly leading to arbitrary code execution in backend.
+       [bouyer, ticket #1358]
+