[src/netbsd-7]: src/doc 1071

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/620afba20a2f
branches:  netbsd-7
changeset: 799748:620afba20a2f
user:      snj <snj%NetBSD.org@localhost>
date:      Fri Jan 08 21:05:37 2016 +0000

description:
1071

diffstat:

 doc/CHANGES-7.1 |  18 +++++++++++++++++-
 1 files changed, 17 insertions(+), 1 deletions(-)

diffs (29 lines):

diff -r 1e78f5c0a128 -r 620afba20a2f doc/CHANGES-7.1
--- a/doc/CHANGES-7.1   Fri Jan 08 21:05:14 2016 +0000
+++ b/doc/CHANGES-7.1   Fri Jan 08 21:05:37 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-7.1,v 1.1.2.43 2016/01/05 22:29:48 snj Exp $
+# $NetBSD: CHANGES-7.1,v 1.1.2.44 2016/01/08 21:05:37 snj Exp $
 
 A complete list of changes from the NetBSD 7.0 release to the NetBSD 7.1
 release:
@@ -1736,3 +1736,19 @@
        Make ARM BE8 work.
        [martin, ticket #1058]
 
+sys/arch/xen/include/xen-public/io/ring.h      1.3 via patch
+sys/arch/xen/xen/pciback.c                     1.10 via patch
+sys/arch/xen/xen/xbdback_xenbus.c              1.62 via patch
+sys/arch/xen/xen/xennetback_xenbus.c           1.54 via patch
+
+       Apply patch from xsa155: make sure that the backend won't read
+       parts of the request again (possibly because of compiler
+       optimisations), by using copies and barrier.
+       From XSA155:
+       The compiler can emit optimizations in the PV backend drivers
+       which can lead to double fetch vulnerabilities. Specifically
+       the shared memory between the frontend and backend can be fetched
+       twice (during which time the frontend can alter the contents)
+       possibly leading to arbitrary code execution in backend.
+       [bouyer, ticket #1071]
+