3 files changed, 16 insertions, 1 deletions

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 4119bcdefd1a..ea158fe0c9a4 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -571,6 +571,7 @@ int xen_blkif_schedule(void *arg)
         struct xen_blkif *blkif = arg;
         struct xen_vbd *vbd = &blkif->vbd;
         unsigned long timeout;
+        int ret;
 
         xen_blkif_get(blkif);
 
@@ -599,8 +600,12 @@ int xen_blkif_schedule(void *arg)
                 blkif->waiting_reqs = 0;
                 smp_mb(); /* clear flag *before* checking for work */
 
-                if (do_block_io_op(blkif))
+                ret = do_block_io_op(blkif);
+                if (ret > 0)
                         blkif->waiting_reqs = 1;
+                if (ret == -EACCES)
+                        wait_event_interruptible(blkif->shutdown_wq,
+                                                 kthread_should_stop());
 
 purge_gnt_list:
                 if (blkif->vbd.feature_gnt_persistent &&
@@ -1009,6 +1014,12 @@ __do_block_io_op(struct xen_blkif *blkif)
         rp = blk_rings->common.sring->req_prod;
         rmb(); /* Ensure we see queued requests up to 'rp'. */
 
+        if (RING_REQUEST_PROD_OVERFLOW(&blk_rings->common, rp)) {
+                rc = blk_rings->common.rsp_prod_pvt;
+                pr_warn(DRV_PFX "Frontend provided bogus ring requests (%d - %d = %d). Halting ring processing on dev=%04x\n",
+                        rp, rc, rp - rc, blkif->vbd.pdevice);
+                return -EACCES;
+        }
         while (rc != rp) {
 
                 if (RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, rc))
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index c6b4cb9af6c2..8d8807563d99 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -314,6 +314,8 @@ struct xen_blkif {
         unsigned long long                      st_wr_sect;
 
         wait_queue_head_t       waiting_to_free;
+        /* Thread shutdown wait queue. */
+        wait_queue_head_t       shutdown_wq;
 };
 
 struct seg_buf {
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 7b06f943371c..2e5b69d612ac 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -151,6 +151,7 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
         }
         spin_lock_init(&blkif->pending_free_lock);
         init_waitqueue_head(&blkif->pending_free_wq);
+        init_waitqueue_head(&blkif->shutdown_wq);
 
         return blkif;
 
@@ -231,6 +232,7 @@ static void xen_blkif_disconnect(struct xen_blkif *blkif)
 {
         if (blkif->xenblkd) {
                 kthread_stop(blkif->xenblkd);
+                wake_up(&blkif->shutdown_wq);
                 blkif->xenblkd = NULL;
         }