From: Jan Beulich Date: Tue, 29 Apr 2014 13:11:31 +0000 (+0200) Subject: x86/HVM: restrict HVMOP_set_mem_type X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~5130 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=83bb5eb4d340acebf27b34108fb1dae062146a68;p=xen.git x86/HVM: restrict HVMOP_set_mem_type Permitting arbitrary type changes here has the potential of creating present P2M (and hence EPT/NPT/IOMMU) entries pointing to an invalid MFN (INVALID_MFN truncated to the respective hardware structure field's width). This would become a problem the latest when something real sat at the end of the physical address space; I'm suspecting though that other things might break with such bogus entries. Along with that drop a bogus (and otherwise becoming stale) log message. Afaict the similar operation in p2m_set_mem_access() is safe. This is XSA-92. Signed-off-by: Jan Beulich Reviewed-by: Tim Deegan --- diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 4e14a21e3f..ac05160129 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -4548,12 +4548,10 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg) rc = -EINVAL; goto param_fail4; } - if ( p2m_is_grant(t) ) + if ( !p2m_is_ram(t) && + (!p2m_is_hole(t) || a.hvmmem_type != HVMMEM_mmio_dm) ) { put_gfn(d, pfn); - gdprintk(XENLOG_WARNING, - "type for pfn %#lx changed to grant while " - "we were working?\n", pfn); goto param_fail4; } else