b014cb462c
changes since Xen 4.6.5: mostly bug fixes, including security fixes for XSA206, XSA211 to XSA244. PKGREVISION set to 1 to account for the fact that it's not a stock Xen 4.6.6. Note that, unlike upstream, pv-linear-pt defaults to true, so that NetBSD PV guests (including dom0) will continue to boot without changes to boot.cfg
48 lines
1.8 KiB
Text
48 lines
1.8 KiB
Text
$NetBSD: patch-XSA239,v 1.1 2017/10/17 10:57:34 bouyer Exp $
|
|
|
|
From: Jan Beulich <jbeulich@suse.com>
|
|
Subject: x86/HVM: prefill partially used variable on emulation paths
|
|
|
|
Certain handlers ignore the access size (vioapic_write() being the
|
|
example this was found with), perhaps leading to subsequent reads
|
|
seeing data that wasn't actually written by the guest. For
|
|
consistency and extra safety also do this on the read path of
|
|
hvm_process_io_intercept(), even if this doesn't directly affect what
|
|
guests get to see, as we've supposedly already dealt with read handlers
|
|
leaving data completely unitialized.
|
|
|
|
This is XSA-239.
|
|
|
|
Reported-by: Roger Pau Monné <roger.pau@citrix.com>
|
|
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
--- xen/arch/x86/hvm/emulate.c.orig
|
|
+++ xen/arch/x86/hvm/emulate.c
|
|
@@ -129,7 +129,7 @@ static int hvmemul_do_io(
|
|
.count = *reps,
|
|
.dir = dir,
|
|
.df = df,
|
|
- .data = data,
|
|
+ .data = data_is_addr ? data : 0,
|
|
.data_is_ptr = data_is_addr, /* ioreq_t field name is misleading */
|
|
.state = STATE_IOREQ_READY,
|
|
};
|
|
--- xen/arch/x86/hvm/intercept.c.orig
|
|
+++ xen/arch/x86/hvm/intercept.c
|
|
@@ -127,6 +127,7 @@ int hvm_process_io_intercept(const struc
|
|
addr = (p->type == IOREQ_TYPE_COPY) ?
|
|
p->addr + step * i :
|
|
p->addr;
|
|
+ data = 0;
|
|
rc = ops->read(handler, addr, p->size, &data);
|
|
if ( rc != X86EMUL_OKAY )
|
|
break;
|
|
@@ -161,6 +162,7 @@ int hvm_process_io_intercept(const struc
|
|
{
|
|
if ( p->data_is_ptr )
|
|
{
|
|
+ data = 0;
|
|
switch ( hvm_copy_from_guest_phys(&data, p->data + step * i,
|
|
p->size) )
|
|
{
|