File 64199e0d-x86-HVM-bound-number-of-pca-regions.patch of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 64199e0d-x86-HVM-bound-number-of-pca-regions.patch of Package xen (Revision bfadaa722ca78042251d7971c9d5deeb)

Currently displaying revision bfadaa722ca78042251d7971c9d5deeb , Show latest

# Commit d484dcca7972794ad70cefd3af73fe0328d610f1
# Date 2023-03-21 12:07:41 +0000
# Author Jan Beulich <jbeulich@suse.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/HVM: bound number of pinned cache attribute regions

This is exposed via DMOP, i.e. to potentially not fully privileged
device models. With that we may not permit registration of an (almost)
unbounded amount of such regions.

This is CVE-2022-42333 / part of XSA-428.

Fixes: 642123c5123f ("x86/hvm: provide XEN_DMOP_pin_memory_cacheattr")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

--- a/xen/arch/x86/hvm/mtrr.c
+++ b/xen/arch/x86/hvm/mtrr.c
@@ -595,6 +595,7 @@ int hvm_set_mem_pinned_cacheattr(struct
                                  uint64_t gfn_end, uint32_t type)
 {
     struct hvm_mem_pinned_cacheattr_range *range;
+    unsigned int nr = 0;
     int rc = 1;
 
     if ( !is_hvm_domain(d) )
@@ -666,11 +667,15 @@ int hvm_set_mem_pinned_cacheattr(struct
             rc = -EBUSY;
             break;
         }
+        ++nr;
     }
     rcu_read_unlock(&pinned_cacheattr_rcu_lock);
     if ( rc <= 0 )
         return rc;
 
+    if ( nr >= 64 /* The limit is arbitrary. */ )
+        return -ENOSPC;
+
     range = xzalloc(struct hvm_mem_pinned_cacheattr_range);
     if ( range == NULL )
         return -ENOMEM;

Places

File 64199e0d-x86-HVM-bound-number-of-pca-regions.patch of Package xen (Revision bfadaa722ca78042251d7971c9d5deeb)

Places