[Xen-changelog] [linux-2.6.18-xen] pciback: return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
# Date 1450363193 -3600
# Node ID 1459670cb028b07052fb89169217342bfc5d7e26
# Parent  c3b5fe4e94c6f8623bc59f99cbab6f8467b2953b
pciback: return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X 
enabled

The guest sequence of:

 a) XEN_PCI_OP_enable_msi
 b) XEN_PCI_OP_enable_msi
 c) XEN_PCI_OP_disable_msi

results in hitting an BUG_ON condition in the msi.c code.

The MSI code uses an dev->msi_list to which it adds MSI entries.
Under the above conditions an BUG_ON() can be hit. The device
passed in the guest MUST have MSI capability.

The a) adds the entry to the dev->msi_list and sets msi_enabled.
The b) adds a second entry but adding in to SysFS fails (duplicate entry)
and deletes all of the entries from msi_list and returns (with msi_enabled
is still set).  c) pci_disable_msi passes the msi_enabled checks and hits:

BUG_ON(list_empty(dev_to_msi_list(&dev->dev)));

and blows up.

The patch adds a simple check in the XEN_PCI_OP_enable_msi to guard
against that. The check for msix_enabled is not stricly neccessary.

This is part of CVE-2015-8551 + CVE-2015-8552 / XSA-157.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
Reviewed-by: David Vrabel <david.vrabel@xxxxxxxxxx>
Committed-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r c3b5fe4e94c6 -r 1459670cb028 
drivers/xen/pciback/conf_space_capability_msi.c
--- a/drivers/xen/pciback/conf_space_capability_msi.c   Thu Dec 17 15:38:33 
2015 +0100
+++ b/drivers/xen/pciback/conf_space_capability_msi.c   Thu Dec 17 15:39:53 
2015 +0100
@@ -11,7 +11,14 @@
 int pciback_enable_msi(struct pciback_device *pdev,
                struct pci_dev *dev, struct xen_pci_op *op)
 {
-       int status = pci_enable_msi(dev);
+       int status;
+
+       if (dev->msi_enabled)
+               status = -EALREADY;
+       else if (dev->msix_enabled)
+               status = -ENXIO;
+       else
+               status = pci_enable_msi(dev);
 
        if (status) {
                if (printk_ratelimit())

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog