58 lines
1.7 KiB
Diff
58 lines
1.7 KiB
Diff
|
References: CVE-2012-5514 XSA-30 bnc#789948
|
||
|
|
|
||
|
|
fix error handling of guest_physmap_mark_populate_on_demand()
|
||
|
|
|
||
|
|
The only user of the "out" label bypasses a necessary unlock, thus
|
||
|
|
enabling the caller to lock up Xen.
|
||
|
|
|
||
|
|
Also, the function was never meant to be called by a guest for itself,
|
||
|
|
so rather than inspecting the code paths in depth for potential other
|
||
|
|
problems this might cause, and adjusting e.g. the non-guest printk()
|
||
|
|
in the above error path, just disallow the guest access to it.
|
||
|
|
|
||
|
|
Finally, the printk() (considering its potential of spamming the log,
|
||
|
|
the more that it's not using XENLOG_GUEST), is being converted to
|
||
|
|
P2M_DEBUG(), as debugging is what it apparently was added for in the
|
||
|
|
first place.
|
||
|
|
|
||
|
|
This is XSA-30 / CVE-2012-5514.
|
||
|
|
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Acked-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
|
||
|
|
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
|
||
|
|
|
||
|
|
--- a/xen/arch/x86/mm/p2m-pod.c
|
||
|
|
+++ b/xen/arch/x86/mm/p2m-pod.c
|
||
|
|
@@ -1117,6 +1117,9 @@ guest_physmap_mark_populate_on_demand(st
|
||
|
|
mfn_t omfn;
|
||
|
|
int rc = 0;
|
||
|
|
|
||
|
|
+ if ( !IS_PRIV_FOR(current->domain, d) )
|
||
|
|
+ return -EPERM;
|
||
|
|
+
|
||
|
|
if ( !paging_mode_translate(d) )
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
@@ -1135,8 +1138,7 @@ guest_physmap_mark_populate_on_demand(st
|
||
|
|
omfn = p2m->get_entry(p2m, gfn + i, &ot, &a, 0, NULL);
|
||
|
|
if ( p2m_is_ram(ot) )
|
||
|
|
{
|
||
|
|
- printk("%s: gfn_to_mfn returned type %d!\n",
|
||
|
|
- __func__, ot);
|
||
|
|
+ P2M_DEBUG("gfn_to_mfn returned type %d!\n", ot);
|
||
|
|
rc = -EBUSY;
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
@@ -1160,9 +1162,9 @@ guest_physmap_mark_populate_on_demand(st
|
||
|
|
pod_unlock(p2m);
|
||
|
|
}
|
||
|
|
|
||
|
|
+out:
|
||
|
|
gfn_unlock(p2m, gfn, order);
|
||
|
|
|
||
|
|
-out:
|
||
|
|
return rc;
|
||
|
|
}
|
||
|
|
|