xen/524e9762-x86-percpu-Force-INVALID_PERCPU_AREA-to-non-canonical.patch
Charles Arnold b244ce9e91 - domUloader can no longer be used with the xl toolstack to boot
sles10. Patch pygrub to get the kernel and initrd from the image.
  pygrub-boot-legacy-sles.patch

- bnc#842515 - VUL-0: CVE-2013-4375: XSA-71: xen: qemu disk backend
  (qdisk) resource leak
  CVE-2013-4375-xsa71.patch
- Upstream patches from Jan
  52496bea-x86-properly-handle-hvm_copy_from_guest_-phys-virt-errors.patch (Replaces CVE-2013-4355-xsa63.patch)
  52496c11-x86-mm-shadow-Fix-initialization-of-PV-shadow-L4-tables.patch (Replaces CVE-2013-4356-xsa64.patch)
  52496c32-x86-properly-set-up-fbld-emulation-operand-address.patch (Replaces CVE-2013-4361-xsa66.patch)
  52497c6c-x86-don-t-blindly-create-L3-tables-for-the-direct-map.patch
  524e971b-x86-idle-Fix-get_cpu_idle_time-s-interaction-with-offline-pcpus.patch
  524e9762-x86-percpu-Force-INVALID_PERCPU_AREA-to-non-canonical.patch
  524e983e-Nested-VMX-check-VMX-capability-before-read-VMX-related-MSRs.patch
  524e98b1-Nested-VMX-fix-IA32_VMX_CR4_FIXED1-msr-emulation.patch
  524e9dc0-xsm-forbid-PV-guest-console-reads.patch
  5256a979-x86-check-segment-descriptor-read-result-in-64-bit-OUTS-emulation.patch
  5256be57-libxl-fix-vif-rate-parsing.patch
  5256be84-tools-ocaml-fix-erroneous-free-of-cpumap-in-stub_xc_vcpu_getaffinity.patch
  5256be92-libxl-fix-out-of-memory-error-handling-in-libxl_list_cpupool.patch
  5257a89a-x86-correct-LDT-checks.patch
  5257a8e7-x86-add-address-validity-check-to-guest_map_l1e.patch
  5257a944-x86-check-for-canonical-address-before-doing-page-walks.patch
  525b95f4-scheduler-adjust-internal-locking-interface.patch
  525b9617-sched-fix-race-between-sched_move_domain-and-vcpu_wake.patch
  525e69e8-credit-unpause-parked-vcpu-before-destroying-it.patch
  525faf5e-x86-print-relevant-tail-part-of-filename-for-warnings-and-crashes.patch

- bnc#840196 - L3: MTU size on Dom0 gets reset when booting DomU

OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=276
2013-10-24 21:00:35 +00:00

36 lines
1.4 KiB
Diff

# Commit 7cfb0053629c4dd1a6f01dc43cca7c0c25b8b7bf
# Date 2013-10-04 12:24:34 +0200
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/percpu: Force INVALID_PERCPU_AREA into the non-canonical address region
This causes accidental uses of per_cpu() on a pcpu with an INVALID_PERCPU_AREA
to result in a #GF for attempting to access the middle of the non-canonical
virtual address region.
This is preferable to the current behaviour, where incorrect use of per_cpu()
will result in an effective NULL structure dereference which has security
implication in the context of PV guests.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
--- a/xen/arch/x86/percpu.c
+++ b/xen/arch/x86/percpu.c
@@ -6,7 +6,14 @@
#include <xen/rcupdate.h>
unsigned long __per_cpu_offset[NR_CPUS];
-#define INVALID_PERCPU_AREA (-(long)__per_cpu_start)
+
+/*
+ * Force uses of per_cpu() with an invalid area to attempt to access the
+ * middle of the non-canonical address space resulting in a #GP, rather than a
+ * possible #PF at (NULL + a little) which has security implications in the
+ * context of PV guests.
+ */
+#define INVALID_PERCPU_AREA (0x8000000000000000L - (long)__per_cpu_start)
#define PERCPU_ORDER (get_order_from_bytes(__per_cpu_data_end-__per_cpu_start))
void __init percpu_init_areas(void)