From: Jan Beulich Date: Tue, 20 Jun 2017 12:15:54 +0000 (+0100) Subject: x86/mm: disallow page stealing from HVM domains X-Git-Tag: archive/raspbian/4.8.1-1+rpi1+deb9u3^2~21 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ab6ff8a970d1d590513a14ca0ec7f28768ae2385;p=xen.git x86/mm: disallow page stealing from HVM domains The operation's success can't be controlled by the guest, as the device model may have an active mapping of the page. If we nevertheless permitted this operation, we'd have to add further TLB flushing to prevent scenarios like "Domains A (HVM), B (PV), C (PV); B->target==A Steps: 1. B maps page X from A as writable 2. B unmaps page X without a TLB flush 3. A sends page X to C via GNTTABOP_transfer 4. C maps page X as pagetable (potentially causing a TLB flush in C, but not in B) At this point, X would be mapped as a pagetable in C while being writable through a stale TLB entry in B." A similar scenario could be constructed for A using XENMEM_exchange and some arbitrary PV domain C then having this page allocated. This is XSA-217. Reported-by: Jann Horn Signed-off-by: Jan Beulich Acked-by: George Dunlap Reviewed-by: Konrad Rzeszutek Wilk Gbp-Pq: Name x86mm-disallow-page-stealing-from-hvm-do --- diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 20e94f7af4..c03479b7d3 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4405,6 +4405,9 @@ int steal_page( bool_t drop_dom_ref = 0; const struct domain *owner = dom_xen; + if ( paging_mode_external(d) ) + return -1; + spin_lock(&d->page_alloc_lock); if ( is_xen_heap_page(page) || ((owner = page_get_owner(page)) != d) )