73fd9f3c19
53356c1e-x86-HVM-correct-CPUID-leaf-80000008-handling.patch 533ad1ee-VMX-fix-PAT-value-seen-by-guest.patch 533d413b-x86-mm-fix-checks-against-max_mapped_pfn.patch - bnc#862608 - SLES 11 SP3 vm-install should get RHEL 7 support when released 53206661-pygrub-support-linux16-and-initrd16.patch - Upstream bug fixes 53299d8f-xenconsole-reset-tty-on-failure.patch 53299d8f-xenconsole-tolerate-tty-errors.patch - fix build for armv7l and aarch64 - Remove compiletime strings from qemu-upstream qemu-xen-upstream-megasas-buildtime.patch - bnc#871546 - KMPs are not signed in SUSE:SLE-12:GA? xen.spec - Upstream patches from Jan 532fff53-x86-fix-determination-of-bit-count-for-struct-domain-allocations.patch 5331917d-x86-enforce-preemption-in-HVM_set_mem_access-p2m_set_mem_access.patch - Drop xsa89.patch for upstream version (see bnc#867910, 5331917d-x86-enforce...) OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=309
103 lines
3.2 KiB
Diff
103 lines
3.2 KiB
Diff
References: bnc#867910 CVE-2014-2599 XSA-89
|
|
|
|
# Commit 0fe53c4f279e1a8ef913e71ed000236d21ce96de
|
|
# Date 2014-03-25 15:23:57 +0100
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86: enforce preemption in HVM_set_mem_access / p2m_set_mem_access()
|
|
|
|
Processing up to 4G PFNs may take almost arbitrarily long, so
|
|
preemption is needed here.
|
|
|
|
This is CVE-2014-2599 / XSA-89.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Tim Deegan <tim@xen.org>
|
|
|
|
--- a/xen/arch/x86/hvm/hvm.c
|
|
+++ b/xen/arch/x86/hvm/hvm.c
|
|
@@ -4465,6 +4465,15 @@ long do_hvm_op(unsigned long op, XEN_GUE
|
|
goto param_fail5;
|
|
|
|
rc = p2m_set_mem_access(d, a.first_pfn, a.nr, a.hvmmem_access);
|
|
+ if ( rc > 0 )
|
|
+ {
|
|
+ a.first_pfn += a.nr - rc;
|
|
+ a.nr = rc;
|
|
+ if ( __copy_to_guest(arg, &a, 1) )
|
|
+ rc = -EFAULT;
|
|
+ else
|
|
+ rc = -EAGAIN;
|
|
+ }
|
|
|
|
param_fail5:
|
|
rcu_unlock_domain(d);
|
|
--- a/xen/arch/x86/mm/p2m.c
|
|
+++ b/xen/arch/x86/mm/p2m.c
|
|
@@ -1366,15 +1366,14 @@ void p2m_mem_access_resume(struct domain
|
|
|
|
/* Set access type for a region of pfns.
|
|
* If start_pfn == -1ul, sets the default access type */
|
|
-int p2m_set_mem_access(struct domain *d, unsigned long start_pfn,
|
|
- uint32_t nr, hvmmem_access_t access)
|
|
+long p2m_set_mem_access(struct domain *d, unsigned long pfn, uint32_t nr,
|
|
+ hvmmem_access_t access)
|
|
{
|
|
struct p2m_domain *p2m = p2m_get_hostp2m(d);
|
|
- unsigned long pfn;
|
|
p2m_access_t a, _a;
|
|
p2m_type_t t;
|
|
mfn_t mfn;
|
|
- int rc = 0;
|
|
+ long rc;
|
|
|
|
/* N.B. _not_ static: initializer depends on p2m->default_access */
|
|
p2m_access_t memaccess[] = {
|
|
@@ -1397,14 +1396,17 @@ int p2m_set_mem_access(struct domain *d,
|
|
a = memaccess[access];
|
|
|
|
/* If request to set default access */
|
|
- if ( start_pfn == ~0ull )
|
|
+ if ( pfn == ~0ul )
|
|
{
|
|
p2m->default_access = a;
|
|
return 0;
|
|
}
|
|
|
|
+ if ( !nr )
|
|
+ return 0;
|
|
+
|
|
p2m_lock(p2m);
|
|
- for ( pfn = start_pfn; pfn < start_pfn + nr; pfn++ )
|
|
+ for ( ; ; ++pfn )
|
|
{
|
|
mfn = p2m->get_entry(p2m, pfn, &t, &_a, 0, NULL);
|
|
if ( p2m->set_entry(p2m, pfn, mfn, PAGE_ORDER_4K, t, a) == 0 )
|
|
@@ -1412,6 +1414,13 @@ int p2m_set_mem_access(struct domain *d,
|
|
rc = -ENOMEM;
|
|
break;
|
|
}
|
|
+
|
|
+ /* Check for continuation if it's not the last interation. */
|
|
+ if ( !--nr || hypercall_preempt_check() )
|
|
+ {
|
|
+ rc = nr;
|
|
+ break;
|
|
+ }
|
|
}
|
|
p2m_unlock(p2m);
|
|
return rc;
|
|
--- a/xen/include/asm-x86/p2m.h
|
|
+++ b/xen/include/asm-x86/p2m.h
|
|
@@ -576,8 +576,8 @@ void p2m_mem_access_resume(struct domain
|
|
|
|
/* Set access type for a region of pfns.
|
|
* If start_pfn == -1ul, sets the default access type */
|
|
-int p2m_set_mem_access(struct domain *d, unsigned long start_pfn,
|
|
- uint32_t nr, hvmmem_access_t access);
|
|
+long p2m_set_mem_access(struct domain *d, unsigned long start_pfn,
|
|
+ uint32_t nr, hvmmem_access_t access);
|
|
|
|
/* Get access type for a pfn
|
|
* If pfn == -1ul, gets the default access type */
|