[Xen-devel] [PATCH] x86/msi: Validate the guest-identified PCI devices in pci_prepare_msix()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

As of c/s 1035bb64fd7fd9f05c510466d98566fd82e37ad9
  "PCI: break MSI-X data out of struct pci_dev_info"

pdev->msix is now conditional on whether the device actually has MSI-X
capabilities or not, so validate it before blindly dereferencing what amounts
to a guest-controlled parameter.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
CC: George Dunlap <george.dunlap@xxxxxxxxxxxxx>

---

This has only been compile tested, but is quite obviously needed to prevent
the NULL structure dereference.

George: This (well technically the fix for the underlying problem if this
  patch turns out to be incorrect) really need to be accepted for 4.4, or the
  underlying bug will turn into an XSA.  Currently only unstable is affected.
---
 xen/arch/x86/msi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c
index 284042e..36c5503 100644
--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -1033,7 +1033,7 @@ int pci_prepare_msix(u16 seg, u8 bus, u8 devfn, bool_t 
off)
 
     spin_lock(&pcidevs_lock);
     pdev = pci_get_pdev(seg, bus, devfn);
-    if ( !pdev )
+    if ( !pdev || !pdev->msix )
         rc = -ENODEV;
     else if ( pdev->msix->used_entries != !!off )
         rc = -EBUSY;
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel