[Xen-changelog] [xen-4.1-testing] x86-64: don't allow non-canonical addresses to be set for any callback

[Xen patchbot-4.1-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1346763289 -7200
# Node ID 52f3ddacd148cf6b1cc4567fadc28bcdf161cd6e
# Parent  f4cadbe5ce4bc3e05138c541e17f9601bfc35f1b
x86-64: don't allow non-canonical addresses to be set for any callback

Rather than deferring the detection of these to the point where they
get actually used (the fix for XSA-7, 25480:76eaf5966c05, causing a #GP
to be raised by IRET, which invokes the guest's [fragile] fail-safe
callback), don't even allow such to be set.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Acked-by: Keir Fraser <keir@xxxxxxx>
xen-unstable changeset: 25485:5b6a857411ba
xen-unstable date: Mon Jun 18 15:02:01 UTC 2012
---


diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/domain.c
--- a/xen/arch/x86/domain.c     Tue Sep 04 14:46:12 2012 +0200
+++ b/xen/arch/x86/domain.c     Tue Sep 04 14:54:49 2012 +0200
@@ -681,6 +681,14 @@ int arch_set_info_guest(
     {
         if ( !compat )
         {
+#ifdef __x86_64__
+            if ( !is_canonical_address(c.nat->user_regs.eip) ||
+                 !is_canonical_address(c.nat->event_callback_eip) ||
+                 !is_canonical_address(c.nat->syscall_callback_eip) ||
+                 !is_canonical_address(c.nat->failsafe_callback_eip) )
+                return -EINVAL;
+#endif
+
             fixup_guest_stack_selector(d, c.nat->user_regs.ss);
             fixup_guest_stack_selector(d, c.nat->kernel_ss);
             fixup_guest_code_selector(d, c.nat->user_regs.cs);
@@ -690,7 +698,11 @@ int arch_set_info_guest(
 #endif
 
             for ( i = 0; i < 256; i++ )
+            {
+                if ( !is_canonical_address(c.nat->trap_ctxt[i].address) )
+                    return -EINVAL;
                 fixup_guest_code_selector(d, c.nat->trap_ctxt[i].cs);
+            }
 
             /* LDT safety checks. */
             if ( ((c.nat->ldt_base & (PAGE_SIZE-1)) != 0) ||
diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/domctl.c
--- a/xen/arch/x86/domctl.c     Tue Sep 04 14:46:12 2012 +0200
+++ b/xen/arch/x86/domctl.c     Tue Sep 04 14:54:49 2012 +0200
@@ -1147,6 +1147,9 @@ long arch_do_domctl(
             if ( evc->size != sizeof(*evc) )
                 goto ext_vcpucontext_out;
 #ifdef __x86_64__
+            if ( !is_canonical_address(evc->sysenter_callback_eip) ||
+                 !is_canonical_address(evc->syscall32_callback_eip) )
+                goto ext_vcpucontext_out;
             fixup_guest_code_selector(d, evc->sysenter_callback_cs);
             v->arch.sysenter_callback_cs      = evc->sysenter_callback_cs;
             v->arch.sysenter_callback_eip     = evc->sysenter_callback_eip;
diff -r f4cadbe5ce4b -r 52f3ddacd148 xen/arch/x86/traps.c
--- a/xen/arch/x86/traps.c      Tue Sep 04 14:46:12 2012 +0200
+++ b/xen/arch/x86/traps.c      Tue Sep 04 14:54:49 2012 +0200
@@ -3516,6 +3516,9 @@ long register_guest_nmi_callback(unsigne
     struct domain *d = v->domain;
     struct trap_info *t = &v->arch.guest_context.trap_ctxt[TRAP_nmi];
 
+    if ( !is_canonical_address(address) )
+        return -EINVAL;
+
     t->vector  = TRAP_nmi;
     t->flags   = 0;
     t->cs      = (is_pv_32on64_domain(d) ?
@@ -3643,6 +3646,9 @@ long do_set_trap_table(XEN_GUEST_HANDLE(
         if ( cur.address == 0 )
             break;
 
+        if ( !is_canonical_address(cur.address) )
+            return -EINVAL;
+
         fixup_guest_code_selector(curr->domain, cur.cs);
 
         memcpy(&dst[cur.vector], &cur, sizeof(cur));

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog