[Xen-changelog] [xen stable-4.9] x86/ioreq server: correctly handle bogus XEN_DMOP_{, un}map_io_range_to_ioreq_server arguments

[patchbot@xxxxxxx]

commit ef61bcff39d907fede18aecc57651bd2beed789a
Author:     Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
AuthorDate: Thu Oct 12 15:04:56 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Oct 12 15:04:56 2017 +0200

    x86/ioreq server: correctly handle bogus 
XEN_DMOP_{,un}map_io_range_to_ioreq_server arguments
    
    Misbehaving device model can pass incorrect XEN_DMOP_map/
    unmap_io_range_to_ioreq_server arguments, namely end < start when
    specifying address range. When this happens we hit ASSERT(s <= e) in
    rangeset_contains_range()/rangeset_overlaps_range() with debug builds.
    Production builds will not trap right away but may misbehave later
    while handling such bogus ranges.
    
    This is XSA-238.
    
    Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: d59e55b018cfb79d0c4f794041aff4fe1cd0d570
    master date: 2017-10-12 14:43:02 +0200
---
 xen/arch/x86/hvm/ioreq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index b2a8b0e..8c8bf1f 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -820,6 +820,9 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, 
ioservid_t id,
     struct hvm_ioreq_server *s;
     int rc;
 
+    if ( start > end )
+        return -EINVAL;
+
     spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
 
     rc = -ENOENT;
@@ -872,6 +875,9 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, 
ioservid_t id,
     struct hvm_ioreq_server *s;
     int rc;
 
+    if ( start > end )
+        return -EINVAL;
+
     spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
 
     rc = -ENOENT;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog