[Xen-changelog] [xen stable-4.4] x86: don't allow page table updates on non-PV page tables in do_mmu_update()

[patchbot@xxxxxxx]

commit 2693b755b559ca007599572837f7e83ebdd1681c
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Nov 18 14:27:46 2014 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Nov 18 14:27:46 2014 +0100

    x86: don't allow page table updates on non-PV page tables in do_mmu_update()
    
    paging_write_guest_entry() and paging_cmpxchg_guest_entry() aren't
    consistently supported for non-PV guests (they'd deref NULL for PVH or
    non-HAP HVM ones). Don't allow respective MMU_* operations on the
    page tables of such domains.
    
    This is CVE-2014-8594 / XSA-109.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Tim Deegan <tim@xxxxxxx>
    master commit: e4292c5aac41b80f33d4877104348d5ee7c95aa4
    master date: 2014-11-18 14:15:21 +0100
---
 xen/arch/x86/mm.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 486e520..d1e0346 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3509,6 +3509,10 @@ long do_mmu_update(
         {
             p2m_type_t p2mt;
 
+            rc = -EOPNOTSUPP;
+            if ( unlikely(paging_mode_refcounts(pt_owner)) )
+                break;
+
             xsm_needed |= XSM_MMU_NORMAL_UPDATE;
             if ( get_pte_flags(req.val) & _PAGE_PRESENT )
             {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog