[Xen-changelog] [xen stable-4.8] x86/mm: disallow page stealing from HVM domains

[patchbot@xxxxxxx]

commit a4bca7c3095e4b2deb0171f190313f6d24c7e821
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Jun 20 15:58:40 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jun 20 15:58:40 2017 +0200

    x86/mm: disallow page stealing from HVM domains
    
    The operation's success can't be controlled by the guest, as the device
    model may have an active mapping of the page. If we nevertheless
    permitted this operation, we'd have to add further TLB flushing to
    prevent scenarios like
    
    "Domains A (HVM), B (PV), C (PV); B->target==A
     Steps:
     1. B maps page X from A as writable
     2. B unmaps page X without a TLB flush
     3. A sends page X to C via GNTTABOP_transfer
     4. C maps page X as pagetable (potentially causing a TLB flush in C,
     but not in B)
    
     At this point, X would be mapped as a pagetable in C while being
     writable through a stale TLB entry in B."
    
    A similar scenario could be constructed for A using XENMEM_exchange and
    some arbitrary PV domain C then having this page allocated.
    
    This is XSA-217.
    
    Reported-by: Jann Horn <jannh@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: George Dunlap <george.dunlap@xxxxxxxxxx>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
    master commit: fae7d5be8bb8b7a5b7005c4f3b812a47661a721e
    master date: 2017-06-20 14:29:51 +0200
---
 xen/arch/x86/mm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 20e94f7..c03479b 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4405,6 +4405,9 @@ int steal_page(
     bool_t drop_dom_ref = 0;
     const struct domain *owner = dom_xen;
 
+    if ( paging_mode_external(d) )
+        return -1;
+
     spin_lock(&d->page_alloc_lock);
 
     if ( is_xen_heap_page(page) || ((owner = page_get_owner(page)) != d) )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog