[Xen-changelog] [xen-unstable] VT-d: Sanity check ACPI DMAR struct lengths.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1269509541 0
# Node ID f42ff98a2cdca966dbfd6b16fb763920104cd38e
# Parent  e362fab06d4231eca198874edc8a14b31125a8f1
VT-d: Sanity check ACPI DMAR struct lengths.

Signed-off-by: Weidong Han <weidong.han@xxxxxxxxx>
Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
---
 xen/drivers/passthrough/vtd/dmar.c |   36 ++++++++++++++++++++++++++++++++----
 1 files changed, 32 insertions(+), 4 deletions(-)

diff -r e362fab06d42 -r f42ff98a2cdc xen/drivers/passthrough/vtd/dmar.c
--- a/xen/drivers/passthrough/vtd/dmar.c        Thu Mar 25 09:19:33 2010 +0000
+++ b/xen/drivers/passthrough/vtd/dmar.c        Thu Mar 25 09:32:21 2010 +0000
@@ -361,6 +361,17 @@ static int __init acpi_parse_dev_scope(v
     return 0;
 }
 
+static int __init acpi_dmar_check_length(
+    struct acpi_dmar_entry_header *h, unsigned int min_len)
+{
+    if ( h->length >= min_len )
+        return 0;
+    dprintk(XENLOG_ERR VTDPREFIX,
+            "Invalid ACPI DMAR entry length: 0x%x\n",
+            h->length);
+    return -EINVAL;
+}
+
 static int __init
 acpi_parse_one_drhd(struct acpi_dmar_entry_header *header)
 {
@@ -368,8 +379,11 @@ acpi_parse_one_drhd(struct acpi_dmar_ent
     void *dev_scope_start, *dev_scope_end;
     struct acpi_drhd_unit *dmaru;
     void *addr;
-    int ret = 0;
+    int ret;
     static int include_all = 0;
+
+    if ( (ret = acpi_dmar_check_length(header, sizeof(*drhd))) != 0 )
+        return ret;
 
     dmaru = xmalloc(struct acpi_drhd_unit);
     if ( !dmaru )
@@ -470,7 +484,10 @@ acpi_parse_one_rmrr(struct acpi_dmar_ent
     struct acpi_rmrr_unit *rmrru;
     void *dev_scope_start, *dev_scope_end;
     u64 base_addr = rmrr->base_address, end_addr = rmrr->end_address;
-    int ret = 0;
+    int ret;
+
+    if ( (ret = acpi_dmar_check_length(header, sizeof(*rmrr))) != 0 )
+        return ret;
 
 #ifdef CONFIG_X86
     /* This check is here simply to detect when RMRR values are
@@ -564,9 +581,12 @@ acpi_parse_one_atsr(struct acpi_dmar_ent
 {
     struct acpi_table_atsr *atsr = (struct acpi_table_atsr *)header;
     struct acpi_atsr_unit *atsru;
-    int ret = 0;
+    int ret;
     static int all_ports;
     void *dev_scope_start, *dev_scope_end;
+
+    if ( (ret = acpi_dmar_check_length(header, sizeof(*atsr))) != 0 )
+        return ret;
 
     atsru = xmalloc(struct acpi_atsr_unit);
     if ( !atsru )
@@ -610,7 +630,10 @@ acpi_parse_one_rhsa(struct acpi_dmar_ent
 {
     struct acpi_table_rhsa *rhsa = (struct acpi_table_rhsa *)header;
     struct acpi_rhsa_unit *rhsau;
-    int ret = 0;
+    int ret;
+
+    if ( (ret = acpi_dmar_check_length(header, sizeof(*rhsa))) != 0 )
+        return ret;
 
     rhsau = xmalloc(struct acpi_rhsa_unit);
     if ( !rhsau )
@@ -659,6 +682,11 @@ static int __init acpi_parse_dmar(struct
     while ( ((unsigned long)entry_header) <
             (((unsigned long)dmar) + table->length) )
     {
+        ret = acpi_dmar_check_length(
+            entry_header, sizeof(struct acpi_dmar_entry_header));
+        if ( ret )
+            break;
+
         switch ( entry_header->type )
         {
         case ACPI_DMAR_DRHD:

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog