Re: [PATCH] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one()

[Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>]

On 7/17/26 9:23 AM, Orzel, Michal wrote:
> On 14-Jul-26 21:16, Oleksandr Tyshchenko wrote:
> > A privileged domain on Arm64 can trigger a data abort in the hypervisor
> > by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with
> > space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO.
> >
> > get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io
> > pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then
> > attempts to walk dom_io's P2M table, which is not initialized for
> > pseudo-domains, resulting in a data abort in p2m_get_entry() when
> > it dereferences the invalid pointer returned by p2m_get_root_pointer().
> >
> > Replace get_pg_owner() with explicit domain lookup logic matching
> > the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen),
> > and resolve all other domain IDs via rcu_lock_remote_domain_by_id(),
> > which rejects pseudo-domains (DOMID_IO, etc.) that are not present in
> > the domain hash, returning -ESRCH before any P2M access occurs.
> >
> > Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from 
> > DOMID_XEN")
> > Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
> Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>
>
> I would be ok to take this patch in for 4.22. Oleksii, other maintainers?
Considering that it leads to hypervisor crash and could be triggered by 
domain my opinion is that we want it in 4.22. If someone from 
maintainers don't have something against this patch then:
 Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>

Thanks.

~ Oleksii