Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:Maintenance:114
xen.openSUSE_Evergreen_11.4
CVE-2012-5511-xsa27.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2012-5511-xsa27.patch of Package xen.openSUSE_Evergreen_11.4
hvm: Limit the size of large HVM op batches Doing large p2m updates for HVMOP_track_dirty_vram without preemption ties up the physical processor. Integrating preemption into the p2m updates is hard so simply limit to 1GB which is sufficient for a 15000 * 15000 * 32bpp framebuffer. For HVMOP_modified_memory and HVMOP_set_mem_type preemptible add the necessary machinery to handle preemption. This is CVE-2012-5511 / XSA-27. Signed-off-by: Tim Deegan <tim@xen.org> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> x86/paging: Don't allocate user-controlled amounts of stack memory. This is XSA-27 / CVE-2012-5511. Signed-off-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> v2: Provide definition of GB to fix x86-32 compile. Signed-off-by: Jan Beulich <JBeulich@suse.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> --- xen-4.0.3-testing/xen/arch/x86/hvm/hvm.c.orig 2012-12-12 11:50:54.170562494 +0100 +++ xen-4.0.3-testing/xen/arch/x86/hvm/hvm.c 2012-12-12 12:01:59.418184442 +0100 @@ -2944,6 +2944,9 @@ if ( !is_hvm_domain(d) ) goto param_fail2; + if ( a.nr > GB(1) >> PAGE_SHIFT ) + goto param_fail2; + rc = xsm_hvm_param(d, op); if ( rc ) goto param_fail2; @@ -2970,7 +2973,6 @@ { struct xen_hvm_modified_memory a; struct domain *d; - unsigned long pfn; if ( copy_from_guest(&a, arg, 1) ) return -EFAULT; @@ -2997,8 +2999,9 @@ if ( !paging_mode_log_dirty(d) ) goto param_fail3; - for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ ) - { + while ( a.nr > 0 ) + { + unsigned long pfn = a.first_pfn; p2m_type_t t; mfn_t mfn = gfn_to_mfn(d, pfn, &t); if ( p2m_is_paging(t) ) @@ -3019,6 +3022,19 @@ /* don't take a long time and don't die either */ sh_remove_shadows(d->vcpu[0], mfn, 1, 0); } + + a.first_pfn++; + a.nr--; + + /* Check for continuation if it's not the last interation */ + if ( a.nr > 0 && hypercall_preempt_check() ) + { + if ( copy_to_guest(arg, &a, 1) ) + rc = -EFAULT; + else + rc = -EAGAIN; + break; + } } param_fail3: @@ -3061,7 +3077,6 @@ { struct xen_hvm_set_mem_type a; struct domain *d; - unsigned long pfn; /* Interface types to internal p2m types */ p2m_type_t memtype[] = { @@ -3094,8 +3109,9 @@ if ( a.hvmmem_type >= ARRAY_SIZE(memtype) ) goto param_fail4; - for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ ) - { + while ( a.nr > 0 ) + { + unsigned long pfn = a.first_pfn; p2m_type_t t; p2m_type_t nt; mfn_t mfn; @@ -3131,6 +3147,19 @@ goto param_fail4; } } + + a.first_pfn++; + a.nr--; + + /* Check for continuation if it's not the last interation */ + if ( a.nr > 0 && hypercall_preempt_check() ) + { + if ( copy_to_guest(arg, &a, 1) ) + rc = -EFAULT; + else + rc = -EAGAIN; + goto param_fail4; + } } rc = 0; --- xen-4.0.3-testing/xen/arch/x86/mm/paging.c.orig 2012-12-12 11:50:54.172562403 +0100 +++ xen-4.0.3-testing/xen/arch/x86/mm/paging.c 2012-12-12 11:50:54.172562403 +0100 @@ -486,13 +486,18 @@ if ( !d->arch.paging.log_dirty.fault_count && !d->arch.paging.log_dirty.dirty_count ) { - int size = (nr + BITS_PER_LONG - 1) / BITS_PER_LONG; - unsigned long zeroes[size]; - memset(zeroes, 0x00, size * BYTES_PER_LONG); + static uint8_t zeroes[PAGE_SIZE]; + int off, size; + + size = ((nr + BITS_PER_LONG - 1) / BITS_PER_LONG) * sizeof (long); rv = 0; - if ( copy_to_guest_offset(dirty_bitmap, 0, (uint8_t *) zeroes, - size * BYTES_PER_LONG) != 0 ) - rv = -EFAULT; + for ( off = 0; !rv && off < size; off += sizeof zeroes ) + { + int todo = min(size - off, (int) PAGE_SIZE); + if ( copy_to_guest_offset(dirty_bitmap, off, zeroes, todo) ) + rv = -EFAULT; + off += todo; + } goto out; } d->arch.paging.log_dirty.fault_count = 0; --- xen-4.0.3-testing/xen/include/asm-x86/config.h.orig 2012-12-12 11:50:54.149563451 +0100 +++ xen-4.0.3-testing/xen/include/asm-x86/config.h 2012-12-12 12:03:19.064538932 +0100 @@ -108,6 +108,9 @@ extern unsigned char trampoline_cpu_started; extern char wakeup_start[]; extern unsigned int video_mode, video_flags; + +#define GB(_gb) (_gb ## UL << 30) + #endif #if defined(__x86_64__) @@ -123,7 +126,6 @@ #define PML4_ADDR(_slot) \ ((((_slot ## UL) >> 8) * 0xffff000000000000UL) | \ (_slot ## UL << PML4_ENTRY_BITS)) -#define GB(_gb) (_gb ## UL << 30) #else #define PML4_ENTRY_BYTES (1 << PML4_ENTRY_BITS) #define PML4_ADDR(_slot) \
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor