[Xen-changelog] [xen stable-4.7] x86/ioreq server: correctly handle bogus XEN_DMOP_{, un}map_io_range_to_ioreq_server arguments

[patchbot@xxxxxxx]

commit e61be54bfa548a6ecccdee87b7691efe00e02fc7
Author:     Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
AuthorDate: Thu Oct 12 15:26:32 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Oct 12 15:26:32 2017 +0200

    x86/ioreq server: correctly handle bogus 
XEN_DMOP_{,un}map_io_range_to_ioreq_server arguments
    
    Misbehaving device model can pass incorrect XEN_DMOP_map/
    unmap_io_range_to_ioreq_server arguments, namely end < start when
    specifying address range. When this happens we hit ASSERT(s <= e) in
    rangeset_contains_range()/rangeset_overlaps_range() with debug builds.
    Production builds will not trap right away but may misbehave later
    while handling such bogus ranges.
    
    This is XSA-238.
    
    Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: d59e55b018cfb79d0c4f794041aff4fe1cd0d570
    master date: 2017-10-12 14:43:02 +0200
---
 xen/arch/x86/hvm/ioreq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index 46b9386..d392a30 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -818,6 +818,9 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, 
ioservid_t id,
     struct hvm_ioreq_server *s;
     int rc;
 
+    if ( start > end )
+        return -EINVAL;
+
     spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
 
     rc = -ENOENT;
@@ -870,6 +873,9 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, 
ioservid_t id,
     struct hvm_ioreq_server *s;
     int rc;
 
+    if ( start > end )
+        return -EINVAL;
+
     spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
 
     rc = -ENOENT;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog