[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [qemu-xen-traditional stable-4.4] xen: fix ioreq handling
commit 851b5ee8ae2a841373d605ae6f755cb33a3626f9 Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Tue Nov 29 18:38:24 2016 +0000 Commit: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> CommitDate: Tue Nov 29 18:39:00 2016 +0000 xen: fix ioreq handling Avoid double fetches and bounds check size to avoid overflowing internal variables. This is XSA-197. Reported-by: yanghongke <yanghongke@xxxxxxxxxx> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Reviewed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx> (cherry picked from commit fadd27b1a7d6f5cfc4786ef09d60b368e44226ad) --- i386-dm/helper2.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/i386-dm/helper2.c b/i386-dm/helper2.c index 63a938b..8926e0a 100644 --- a/i386-dm/helper2.c +++ b/i386-dm/helper2.c @@ -374,6 +374,11 @@ static void cpu_ioreq_pio(CPUState *env, ioreq_t *req) { uint32_t i; + if (req->size > sizeof(unsigned long)) { + fprintf(stderr, "PIO: bad size (%u)\n", req->size); + exit(-1); + } + if (req->dir == IOREQ_READ) { if (!req->data_is_ptr) { req->data = do_inp(env, req->addr, req->size); @@ -403,6 +408,11 @@ static void cpu_ioreq_move(CPUState *env, ioreq_t *req) { uint32_t i; + if (req->size > sizeof(req->data)) { + fprintf(stderr, "MMIO: bad size (%u)\n", req->size); + exit(-1); + } + if (!req->data_is_ptr) { if (req->dir == IOREQ_READ) { for (i = 0; i < req->count; i++) { @@ -506,11 +516,13 @@ static int __handle_buffered_iopage(CPUState *env) req.df = 1; req.type = buf_req->type; req.data_is_ptr = 0; + xen_rmb(); qw = (req.size == 8); if (qw) { buf_req = &buffered_io_page->buf_ioreq[ (buffered_io_page->read_pointer+1) % IOREQ_BUFFER_SLOT_NUM]; req.data |= ((uint64_t)buf_req->data) << 32; + xen_rmb(); } __handle_ioreq(env, &req); @@ -543,7 +555,11 @@ static void cpu_handle_ioreq(void *opaque) __handle_buffered_iopage(env); if (req) { - __handle_ioreq(env, req); + ioreq_t copy = *req; + + xen_rmb(); + __handle_ioreq(env, ©); + req->data = copy.data; if (req->state != STATE_IOREQ_INPROCESS) { fprintf(logfile, "Badness in I/O request ... not in service?!: " -- generated by git-patchbot for /home/xen/git/qemu-xen-traditional.git#stable-4.4 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx https://lists.xenproject.org/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |