Olaf Hering
b9d38dfc8d
- remove xen.migrate.tools_notify_restore_to_hangup_during_migration_--abort_if_busy.patch It changed migration protocol and upstream wants a different solution - bnc#802221 - fix xenpaging readd xenpaging.qemu.flush-cache.patch - Upstream patches from Jan 26891-x86-S3-Fix-cpu-pool-scheduling-after-suspend-resume.patch 26930-x86-EFI-fix-runtime-call-status-for-compat-mode-Dom0.patch - Additional fix for bnc#816159 CVE-2013-1918-xsa45-followup.patch - bnc#817068 - Xen guest with >1 sr-iov vf won't start xen-managed-pci-device.patch - Update to Xen 4.2.2 c/s 26064 The following recent security patches are included in the tarball CVE-2013-0151-xsa34.patch (bnc#797285) CVE-2012-6075-xsa41.patch (bnc#797523) CVE-2013-1917-xsa44.patch (bnc#813673) CVE-2013-1919-xsa46.patch (bnc#813675) - Upstream patch from Jan 26902-x86-EFI-pass-boot-services-variable-info-to-runtime-code.patch - bnc#816159 - VUL-0: xen: CVE-2013-1918: XSA-45: Several long latency operations are not preemptible CVE-2013-1918-xsa45-1-vcpu-destroy-pagetables-preemptible.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=237
44 lines
1.7 KiB
Diff
44 lines
1.7 KiB
Diff
# HG changeset patch
|
|
# User Daniel De Graaf <dgdegra@tycho.nsa.gov>
|
|
# Date 1348653367 -7200
|
|
# Node ID 8278d7d8fa485996f51134c5265fceaf239adf6a
|
|
# Parent b83f414ccf7a6e4e077a10bc422cf3f6c7d30566
|
|
x86: check remote MMIO remap permissions
|
|
|
|
When a domain is mapping pages from a different pg_owner domain, the
|
|
iomem_access checks are currently only applied to the pg_owner domain,
|
|
potentially allowing a domain with a more restrictive iomem_access
|
|
policy to have the pages mapped into its page tables. To catch this,
|
|
also check the owner of the page tables. The current domain does not
|
|
need to be checked because the ability to manipulate a domain's page
|
|
tables implies full access to the target domain, so checking that
|
|
domain's permission is sufficient.
|
|
|
|
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
|
|
Committed-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
Index: xen-4.2.2-testing/xen/arch/x86/mm.c
|
|
===================================================================
|
|
--- xen-4.2.2-testing.orig/xen/arch/x86/mm.c
|
|
+++ xen-4.2.2-testing/xen/arch/x86/mm.c
|
|
@@ -884,6 +884,19 @@ get_page_from_l1e(
|
|
return -EINVAL;
|
|
}
|
|
|
|
+ if ( pg_owner != l1e_owner &&
|
|
+ !iomem_access_permitted(l1e_owner, mfn, mfn) )
|
|
+ {
|
|
+ if ( mfn != (PADDR_MASK >> PAGE_SHIFT) ) /* INVALID_MFN? */
|
|
+ {
|
|
+ MEM_LOG("Dom%u attempted to map I/O space %08lx in dom%u to dom%u",
|
|
+ curr->domain->domain_id, mfn, pg_owner->domain_id,
|
|
+ l1e_owner->domain_id);
|
|
+ return -EPERM;
|
|
+ }
|
|
+ return -EINVAL;
|
|
+ }
|
|
+
|
|
if ( !(l1f & _PAGE_RW) ||
|
|
!rangeset_contains_singleton(mmio_ro_ranges, mfn) )
|
|
return 0;
|