[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen-4.1-testing] x86-64: don't allow non-canonical addresses to be set for any callback
# HG changeset patch # User Jan Beulich <jbeulich@xxxxxxxx> # Date 1346763289 -7200 # Node ID 52f3ddacd148cf6b1cc4567fadc28bcdf161cd6e # Parent f4cadbe5ce4bc3e05138c541e17f9601bfc35f1b x86-64: don't allow non-canonical addresses to be set for any callback Rather than deferring the detection of these to the point where they get actually used (the fix for XSA-7, 25480:76eaf5966c05, causing a #GP to be raised by IRET, which invokes the guest's [fragile] fail-safe callback), don't even allow such to be set. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Acked-by: Keir Fraser <keir@xxxxxxx> xen-unstable changeset: 25485:5b6a857411ba xen-unstable date: Mon Jun 18 15:02:01 UTC 2012 --- diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/domain.c --- a/xen/arch/x86/domain.c Tue Sep 04 14:46:12 2012 +0200 +++ b/xen/arch/x86/domain.c Tue Sep 04 14:54:49 2012 +0200 @@ -681,6 +681,14 @@ int arch_set_info_guest( { if ( !compat ) { +#ifdef __x86_64__ + if ( !is_canonical_address(c.nat->user_regs.eip) || + !is_canonical_address(c.nat->event_callback_eip) || + !is_canonical_address(c.nat->syscall_callback_eip) || + !is_canonical_address(c.nat->failsafe_callback_eip) ) + return -EINVAL; +#endif + fixup_guest_stack_selector(d, c.nat->user_regs.ss); fixup_guest_stack_selector(d, c.nat->kernel_ss); fixup_guest_code_selector(d, c.nat->user_regs.cs); @@ -690,7 +698,11 @@ int arch_set_info_guest( #endif for ( i = 0; i < 256; i++ ) + { + if ( !is_canonical_address(c.nat->trap_ctxt[i].address) ) + return -EINVAL; fixup_guest_code_selector(d, c.nat->trap_ctxt[i].cs); + } /* LDT safety checks. */ if ( ((c.nat->ldt_base & (PAGE_SIZE-1)) != 0) || diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/domctl.c --- a/xen/arch/x86/domctl.c Tue Sep 04 14:46:12 2012 +0200 +++ b/xen/arch/x86/domctl.c Tue Sep 04 14:54:49 2012 +0200 @@ -1147,6 +1147,9 @@ long arch_do_domctl( if ( evc->size != sizeof(*evc) ) goto ext_vcpucontext_out; #ifdef __x86_64__ + if ( !is_canonical_address(evc->sysenter_callback_eip) || + !is_canonical_address(evc->syscall32_callback_eip) ) + goto ext_vcpucontext_out; fixup_guest_code_selector(d, evc->sysenter_callback_cs); v->arch.sysenter_callback_cs = evc->sysenter_callback_cs; v->arch.sysenter_callback_eip = evc->sysenter_callback_eip; diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/traps.c --- a/xen/arch/x86/traps.c Tue Sep 04 14:46:12 2012 +0200 +++ b/xen/arch/x86/traps.c Tue Sep 04 14:54:49 2012 +0200 @@ -3516,6 +3516,9 @@ long register_guest_nmi_callback(unsigne struct domain *d = v->domain; struct trap_info *t = &v->arch.guest_context.trap_ctxt[TRAP_nmi]; + if ( !is_canonical_address(address) ) + return -EINVAL; + t->vector = TRAP_nmi; t->flags = 0; t->cs = (is_pv_32on64_domain(d) ? @@ -3643,6 +3646,9 @@ long do_set_trap_table(XEN_GUEST_HANDLE( if ( cur.address == 0 ) break; + if ( !is_canonical_address(cur.address) ) + return -EINVAL; + fixup_guest_code_selector(curr->domain, cur.cs); memcpy(&dst[cur.vector], &cur, sizeof(cur)); _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |