[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen stable-4.6] x86/mm: PV superpage handling lacks sanity checks
commit fa109ca50760cc1f67eb7deed9d03e9f065ee293 Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Wed Jan 20 13:53:33 2016 +0100 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Wed Jan 20 13:53:33 2016 +0100 x86/mm: PV superpage handling lacks sanity checks MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before dereferencing pointers into the superpage frame table. Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> get_superpage() has a similar issue. This is CVE-2016-1570 / XSA-167. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx> master commit: 47abf29a9255b2e7b94e56d66b455d0a584b68b8 master date: 2016-01-20 13:49:23 +0100 --- xen/arch/x86/mm.c | 37 ++++++++++++------------------------- 1 files changed, 12 insertions(+), 25 deletions(-) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index b65c3a5..854a635 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -2624,6 +2624,9 @@ int get_superpage(unsigned long mfn, struct domain *d) ASSERT(opt_allow_superpage); + if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) ) + return -EINVAL; + spage = mfn_to_spage(mfn); y = spage->type_info; do { @@ -3401,42 +3404,26 @@ long do_mmuext_op( } case MMUEXT_MARK_SUPER: + case MMUEXT_UNMARK_SUPER: { unsigned long mfn = op.arg1.mfn; - if ( unlikely(d != pg_owner) ) - rc = -EPERM; - else if ( mfn & (L1_PAGETABLE_ENTRIES-1) ) - { - MEM_LOG("Unaligned superpage reference mfn %lx", mfn); - okay = 0; - } - else if ( !opt_allow_superpage ) + if ( !opt_allow_superpage ) { MEM_LOG("Superpages disallowed"); rc = -ENOSYS; } - else - rc = mark_superpage(mfn_to_spage(mfn), d); - break; - } - - case MMUEXT_UNMARK_SUPER: - { - unsigned long mfn = op.arg1.mfn; - - if ( unlikely(d != pg_owner) ) + else if ( unlikely(d != pg_owner) ) rc = -EPERM; - else if ( mfn & (L1_PAGETABLE_ENTRIES-1) ) + else if ( mfn & (L1_PAGETABLE_ENTRIES - 1) ) { MEM_LOG("Unaligned superpage reference mfn %lx", mfn); - okay = 0; - } - else if ( !opt_allow_superpage ) - { - MEM_LOG("Superpages disallowed"); - rc = -ENOSYS; + rc = -EINVAL; } + else if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) ) + rc = -EINVAL; + else if ( op.cmd == MMUEXT_MARK_SUPER ) + rc = mark_superpage(mfn_to_spage(mfn), d); else rc = unmark_superpage(mfn_to_spage(mfn)); break; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.6 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |