[Xen-changelog] [xen stable-4.9] x86/HVM: prefill partially used variable on emulation paths

[patchbot@xxxxxxx]

commit d8426300dbdc06ba77f97a60ada018b37aea5ad1
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Oct 12 15:05:44 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Oct 12 15:05:44 2017 +0200

    x86/HVM: prefill partially used variable on emulation paths
    
    Certain handlers ignore the access size (vioapic_write() being the
    example this was found with), perhaps leading to subsequent reads
    seeing data that wasn't actually written by the guest. For
    consistency and extra safety also do this on the read path of
    hvm_process_io_intercept(), even if this doesn't directly affect what
    guests get to see, as we've supposedly already dealt with read handlers
    leaving data completely unitialized.
    
    This is XSA-239.
    
    Reported-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 0d4732ac29b63063764c29fa3bd8946daf67d6f3
    master date: 2017-10-12 14:43:26 +0200
---
 xen/arch/x86/hvm/emulate.c   | 2 +-
 xen/arch/x86/hvm/intercept.c | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index af09dcc..9e63614 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -129,7 +129,7 @@ static int hvmemul_do_io(
         .count = *reps,
         .dir = dir,
         .df = df,
-        .data = data,
+        .data = data_is_addr ? data : 0,
         .data_is_ptr = data_is_addr, /* ioreq_t field name is misleading */
         .state = STATE_IOREQ_READY,
     };
diff --git a/xen/arch/x86/hvm/intercept.c b/xen/arch/x86/hvm/intercept.c
index e51efd5..72d3353 100644
--- a/xen/arch/x86/hvm/intercept.c
+++ b/xen/arch/x86/hvm/intercept.c
@@ -127,6 +127,7 @@ int hvm_process_io_intercept(const struct hvm_io_handler 
*handler,
             addr = (p->type == IOREQ_TYPE_COPY) ?
                    p->addr + step * i :
                    p->addr;
+            data = 0;
             rc = ops->read(handler, addr, p->size, &data);
             if ( rc != X86EMUL_OKAY )
                 break;
@@ -161,6 +162,7 @@ int hvm_process_io_intercept(const struct hvm_io_handler 
*handler,
         {
             if ( p->data_is_ptr )
             {
+                data = 0;
                 switch ( hvm_copy_from_guest_phys(&data, p->data + step * i,
                                                   p->size) )
                 {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog