[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH v2] xen/guest_access: Harden *copy_to_guest_offset() to prevent const dest operand
From: Julien Grall <jgrall@xxxxxxxxxx> At the moment, *copy_to_guest_offset() will allow the hypervisor to copy data to guest handle marked const. Thankfully, no users of the helper will do that. Rather than hoping this can be caught during review, harden copy_to_guest_offset() so the build will fail if such users are introduced. There is no easy way to check whether a const is NULL in C99. The approach used is to introduce an unused variable that is non-const and assign the handle. If the handle were const, this would fail at build because without an explicit cast, it is not possible to assign a const variable to a non-const variable. Suggested-by: Jan Beulich <jbeulich@xxxxxxxx> Signed-off-by: Julien Grall <jgrall@xxxxxxxxxx> --- Changes in v2: - Use a void * variable to check the handle is not const. --- xen/include/asm-arm/guest_access.h | 9 +++++++++ xen/include/asm-x86/guest_access.h | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/xen/include/asm-arm/guest_access.h b/xen/include/asm-arm/guest_access.h index 8997a1cbfe..4046d50347 100644 --- a/xen/include/asm-arm/guest_access.h +++ b/xen/include/asm-arm/guest_access.h @@ -74,10 +74,14 @@ int access_guest_memory_by_ipa(struct domain *d, paddr_t ipa, void *buf, /* * Copy an array of objects to guest context via a guest handle, * specifying an offset into the guest array. + * + * The variable _t is only here to catch at build time whether we are + * copying back to a const guest handle. */ #define copy_to_guest_offset(hnd, off, ptr, nr) ({ \ const typeof(*(ptr)) *_s = (ptr); \ char (*_d)[sizeof(*_s)] = (void *)(hnd).p; \ + void *__maybe_unused _t = (hnd).p; \ ((void)((hnd).p == (ptr))); \ raw_copy_to_guest(_d+(off), _s, sizeof(*_s)*(nr)); \ }) @@ -124,9 +128,14 @@ int access_guest_memory_by_ipa(struct domain *d, paddr_t ipa, void *buf, #define guest_handle_okay(hnd, nr) (1) #define guest_handle_subrange_okay(hnd, first, last) (1) +/* + * The variable _t is only here to catch at build time whether we are + * copying back to a const guest handle. + */ #define __copy_to_guest_offset(hnd, off, ptr, nr) ({ \ const typeof(*(ptr)) *_s = (ptr); \ char (*_d)[sizeof(*_s)] = (void *)(hnd).p; \ + void *__maybe_unused _t = (hnd).p; \ ((void)((hnd).p == (ptr))); \ __raw_copy_to_guest(_d+(off), _s, sizeof(*_s)*(nr));\ }) diff --git a/xen/include/asm-x86/guest_access.h b/xen/include/asm-x86/guest_access.h index ca700c959a..0b58f2baee 100644 --- a/xen/include/asm-x86/guest_access.h +++ b/xen/include/asm-x86/guest_access.h @@ -83,10 +83,14 @@ /* * Copy an array of objects to guest context via a guest handle, * specifying an offset into the guest array. + * + * The variable _t is only here to catch at build time whether we are + * copying back to a const guest handle. */ #define copy_to_guest_offset(hnd, off, ptr, nr) ({ \ const typeof(*(ptr)) *_s = (ptr); \ char (*_d)[sizeof(*_s)] = (void *)(hnd).p; \ + void *__maybe_unused _t = (hnd).p; \ ((void)((hnd).p == (ptr))); \ raw_copy_to_guest(_d+(off), _s, sizeof(*_s)*(nr)); \ }) @@ -134,9 +138,14 @@ (last)-(first)+1, \ sizeof(*(hnd).p))) +/* + * The variable _t is only here to catch at build time whether we are + * copying back to a const guest handle. + */ #define __copy_to_guest_offset(hnd, off, ptr, nr) ({ \ const typeof(*(ptr)) *_s = (ptr); \ char (*_d)[sizeof(*_s)] = (void *)(hnd).p; \ + void *__maybe_unused _t = (hnd).p; \ ((void)((hnd).p == (ptr))); \ __raw_copy_to_guest(_d+(off), _s, sizeof(*_s)*(nr));\ }) -- 2.17.1
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |