[Xen-changelog] [xen stable-4.1] VT-d: protect against bogus information coming from BIOS

[patchbot@xxxxxxx]

commit 7c2dc5b8e80234153e7aaa32b9a511d0738bd39e
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Aug 20 16:10:44 2013 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Aug 20 16:10:44 2013 +0200

    VT-d: protect against bogus information coming from BIOS
    
    Add checks similar to those done by Linux: The DRHD address must not
    be all zeros or all ones (Linux only checks for zero), and capabilities
    as well as extended capabilities must not be all ones.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Ben Guthro <benjamin.guthro@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Tested-by: Ben Guthro <benjamin.guthro@xxxxxxxxxx>
    Acked by: Yang Zhang <yang.z.zhang@xxxxxxxxx>
    Acked-by: Xiantao Zhang <xiantao.zhang@xxxxxxxxx>
    master commit: e8e8b030ecf916fea19639f0b6a446c1c9dbe174
    master date: 2013-08-14 11:18:24 +0200
---
 xen/drivers/passthrough/vtd/dmar.c  |    3 +++
 xen/drivers/passthrough/vtd/iommu.c |    3 +++
 2 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/dmar.c 
b/xen/drivers/passthrough/vtd/dmar.c
index 5ecade2..0f117b1 100644
--- a/xen/drivers/passthrough/vtd/dmar.c
+++ b/xen/drivers/passthrough/vtd/dmar.c
@@ -400,6 +400,9 @@ acpi_parse_one_drhd(struct acpi_dmar_entry_header *header)
     if ( (ret = acpi_dmar_check_length(header, sizeof(*drhd))) != 0 )
         return ret;
 
+    if ( !drhd->address || !(drhd->address + 1) )
+        return -ENODEV;
+
     dmaru = xmalloc(struct acpi_drhd_unit);
     if ( !dmaru )
         return -ENOMEM;
diff --git a/xen/drivers/passthrough/vtd/iommu.c 
b/xen/drivers/passthrough/vtd/iommu.c
index bbfcf2a..c243287 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -1182,6 +1182,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd)
         dprintk(VTDPREFIX,
                 "cap = %"PRIx64" ecap = %"PRIx64"\n", iommu->cap, iommu->ecap);
     }
+    if ( !(iommu->cap + 1) || !(iommu->ecap + 1) )
+        return -ENODEV;
+
     if ( cap_fault_reg_offset(iommu->cap) +
          cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_REG_LEN >= PAGE_SIZE ||
          ecap_iotlb_offset(iommu->ecap) >= PAGE_SIZE )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.1

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog