a89d75605e
on Xen 576001df-x86-time-use-local-stamp-in-TSC-calibration-fast-path.patch 5769106e-x86-generate-assembler-equates-for-synthesized.patch 57a1e603-x86-time-adjust-local-system-time-initialization.patch 57a1e64c-x86-time-introduce-and-use-rdtsc_ordered.patch 57a2f6ac-x86-time-calibrate-TSC-against-platform-timer.patch - bsc#991934 - xen hypervisor crash in csched_acct 57973099-have-schedulers-revise-initial-placement.patch 579730e6-remove-buggy-initial-placement-algorithm.patch - bsc#988675 - VUL-0: CVE-2016-6258: xen: x86: Privilege escalation in PV guests (XSA-182) 57976073-x86-remove-unsafe-bits-from-mod_lN_entry-fastpath.patch - bsc#988676 - VUL-0: CVE-2016-6259: xen: x86: Missing SMAP whitelisting in 32-bit exception / event delivery (XSA-183) 57976078-x86-avoid-SMAP-violation-in-compat_create_bounce_frame.patch - Upstream patches from Jan 57a30261-x86-support-newer-Intel-CPU-models.patch - bsc#985503 - vif-route broken vif-route.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=445
95 lines
3.9 KiB
Diff
95 lines
3.9 KiB
Diff
References: bsc#988675 CVE-2016-6258 XSA-182
|
|
|
|
# Commit e1bff4c2ea3b32464510ac00c320bba28a8dbcca
|
|
# Date 2016-07-26 14:06:59 +0100
|
|
# Author Andrew Cooper <andrew.cooper3@citrix.com>
|
|
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
|
|
x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
|
|
|
|
All changes in writeability and cacheability must go through full
|
|
re-validation.
|
|
|
|
Rework the logic as a whitelist, to make it clearer to follow.
|
|
|
|
This is XSA-182
|
|
|
|
Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com>
|
|
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
Reviewed-by: Tim Deegan <tim@xen.org>
|
|
|
|
--- a/xen/arch/x86/mm.c
|
|
+++ b/xen/arch/x86/mm.c
|
|
@@ -1852,6 +1852,14 @@ static inline int update_intpte(intpte_t
|
|
_t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \
|
|
(_m), (_v), (_ad))
|
|
|
|
+/*
|
|
+ * PTE flags that a guest may change without re-validating the PTE.
|
|
+ * All other bits affect translation, caching, or Xen's safety.
|
|
+ */
|
|
+#define FASTPATH_FLAG_WHITELIST \
|
|
+ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \
|
|
+ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER)
|
|
+
|
|
/* Update the L1 entry at pl1e to new value nl1e. */
|
|
static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
|
|
unsigned long gl1mfn, int preserve_ad,
|
|
@@ -1891,9 +1899,8 @@ static int mod_l1_entry(l1_pgentry_t *pl
|
|
nl1e = l1e_from_pfn(page_to_mfn(page), l1e_get_flags(nl1e));
|
|
}
|
|
|
|
- /* Fast path for identical mapping, r/w, presence, and cachability. */
|
|
- if ( !l1e_has_changed(ol1e, nl1e,
|
|
- PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l1e(nl1e, pt_dom);
|
|
rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu,
|
|
@@ -1970,11 +1977,8 @@ static int mod_l2_entry(l2_pgentry_t *pl
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l2e_has_changed(ol2e, nl2e,
|
|
- unlikely(opt_allow_superpage)
|
|
- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
|
|
- : _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l2e(nl2e, d);
|
|
if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
|
|
@@ -2039,8 +2043,8 @@ static int mod_l3_entry(l3_pgentry_t *pl
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l3e(nl3e, d);
|
|
rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad);
|
|
@@ -2103,8 +2107,8 @@ static int mod_l4_entry(l4_pgentry_t *pl
|
|
return -EINVAL;
|
|
}
|
|
|
|
- /* Fast path for identical mapping and presence. */
|
|
- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) )
|
|
+ /* Fast path for sufficiently-similar mappings. */
|
|
+ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) )
|
|
{
|
|
adjust_guest_l4e(nl4e, d);
|
|
rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad);
|
|
--- a/xen/include/asm-x86/page.h
|
|
+++ b/xen/include/asm-x86/page.h
|
|
@@ -313,6 +313,7 @@ void efi_update_l4_pgtable(unsigned int
|
|
#define _PAGE_AVAIL2 _AC(0x800,U)
|
|
#define _PAGE_AVAIL _AC(0xE00,U)
|
|
#define _PAGE_PSE_PAT _AC(0x1000,U)
|
|
+#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12)
|
|
#define _PAGE_NX (cpu_has_nx ? _PAGE_NX_BIT : 0)
|
|
/* non-architectural flags */
|
|
#define _PAGE_PAGED 0x2000U
|