From: Vitaly Kuznetsov Date: Tue, 5 Sep 2017 11:41:37 +0000 (+0200) Subject: x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server... X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~1100 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=d59e55b018cfb79d0c4f794041aff4fe1cd0d570;p=xen.git x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server arguments Misbehaving device model can pass incorrect XEN_DMOP_map/ unmap_io_range_to_ioreq_server arguments, namely end < start when specifying address range. When this happens we hit ASSERT(s <= e) in rangeset_contains_range()/rangeset_overlaps_range() with debug builds. Production builds will not trap right away but may misbehave later while handling such bogus ranges. This is XSA-238. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Jan Beulich --- diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c index f2e0b3f74a..d5afe20cc8 100644 --- a/xen/arch/x86/hvm/ioreq.c +++ b/xen/arch/x86/hvm/ioreq.c @@ -820,6 +820,9 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + if ( start > end ) + return -EINVAL; + spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock); rc = -ENOENT; @@ -872,6 +875,9 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + if ( start > end ) + return -EINVAL; + spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock); rc = -ENOENT;