Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:Maintenance:114
xen.openSUSE_Evergreen_11.4
25485-x86_64-canonical-checks.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 25485-x86_64-canonical-checks.patch of Package xen.openSUSE_Evergreen_11.4
# HG changeset patch # User Jan Beulich <jbeulich@suse.com> # Date 1340031721 -7200 # Node ID 5b6a857411ba5212c71885a2fd39cae4c3d8231c # Parent c272cfe25bea00375fb65c339926c83b6e830230 x86-64: don't allow non-canonical addresses to be set for any callback Rather than deferring the detection of these to the point where they get actually used (the fix for XSA-7, 25480:76eaf5966c05, causing a #GP to be raised by IRET, which invokes the guest's [fragile] fail-safe callback), don't even allow such to be set. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org> --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -631,6 +631,14 @@ int arch_set_info_guest( { if ( !compat ) { +#ifdef __x86_64__ + if ( !is_canonical_address(c.nat->user_regs.eip) || + !is_canonical_address(c.nat->event_callback_eip) || + !is_canonical_address(c.nat->syscall_callback_eip) || + !is_canonical_address(c.nat->failsafe_callback_eip) ) + return -EINVAL; +#endif + fixup_guest_stack_selector(d, c.nat->user_regs.ss); fixup_guest_stack_selector(d, c.nat->kernel_ss); fixup_guest_code_selector(d, c.nat->user_regs.cs); @@ -640,7 +648,11 @@ int arch_set_info_guest( #endif for ( i = 0; i < 256; i++ ) + { + if ( !is_canonical_address(c.nat->trap_ctxt[i].address) ) + return -EINVAL; fixup_guest_code_selector(d, c.nat->trap_ctxt[i].cs); + } /* LDT safety checks. */ if ( ((c.nat->ldt_base & (PAGE_SIZE-1)) != 0) || --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1146,6 +1146,9 @@ long arch_do_domctl( if ( evc->size != sizeof(*evc) ) goto ext_vcpucontext_out; #ifdef __x86_64__ + if ( !is_canonical_address(evc->sysenter_callback_eip) || + !is_canonical_address(evc->syscall32_callback_eip) ) + goto ext_vcpucontext_out; fixup_guest_code_selector(d, evc->sysenter_callback_cs); v->arch.sysenter_callback_cs = evc->sysenter_callback_cs; v->arch.sysenter_callback_eip = evc->sysenter_callback_eip; --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -3362,6 +3362,9 @@ long register_guest_nmi_callback(unsigne struct domain *d = v->domain; struct trap_info *t = &v->arch.guest_context.trap_ctxt[TRAP_nmi]; + if ( !is_canonical_address(address) ) + return -EINVAL; + t->vector = TRAP_nmi; t->flags = 0; t->cs = (is_pv_32on64_domain(d) ? @@ -3489,6 +3492,9 @@ long do_set_trap_table(XEN_GUEST_HANDLE( if ( cur.address == 0 ) break; + if ( !is_canonical_address(cur.address) ) + return -EINVAL; + fixup_guest_code_selector(curr->domain, cur.cs); memcpy(&dst[cur.vector], &cur, sizeof(cur));
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor