ia64/xen-unstable

changeset 16622:e6069a715fd7

[IA64] Fix vulnerability of copy_to_user in PAL emulation

There is a security vulnerability in PAL emulation since alt-dtlb
miss handler of HVM absolutely inserts a identity-mapped TLB when
psr.vm=0. HVM guest can access an arbitrary machine physical
memory with this security hole. Actually windows 2008 destroys
the content of machine physical address 0x108000.

I think this patch is enough for normal usage. Please see SDM
Vol2 11.10.2.1.3 "Making PAL Procedure Calls in Physical or
Virtual Mode". If the caller has a responsibility of providing
DTR or DTC mapping, xencomm for PAL might be unnecessary.

I confirmed there is no problem in linux, windows 2003, windows
2008 with this patch.

As for PV domain, the same logic can't be used due to only one
vTLB. This patch only checks that the buffer never points VMM
address, that would avoid the vulnerability.

Signed-off-by: Kouya Shimura <kouya@jp.fujitsu.com>
author Alex Williamson <alex.williamson@hp.com>
date Fri Dec 14 10:25:03 2007 -0700 (2007-12-14)
parents a7ede5cb628a
children 9152cf7f5b82
files xen/arch/ia64/xen/fw_emul.c
line diff
     1.1 --- a/xen/arch/ia64/xen/fw_emul.c	Fri Dec 14 10:12:40 2007 -0700
     1.2 +++ b/xen/arch/ia64/xen/fw_emul.c	Fri Dec 14 10:25:03 2007 -0700
     1.3 @@ -37,6 +37,7 @@
     1.4  #include <xen/softirq.h>
     1.5  #include <xen/time.h>
     1.6  #include <asm/debugger.h>
     1.7 +#include <asm/vmx_phy_mode.h>
     1.8  
     1.9  static DEFINE_SPINLOCK(efi_time_services_lock);
    1.10  
    1.11 @@ -570,6 +571,45 @@ sal_emulator (long index, unsigned long 
    1.12  	return ((struct sal_ret_values) {status, r9, r10, r11});
    1.13  }
    1.14  
    1.15 +static int
    1.16 +safe_copy_to_guest(unsigned long to, void *from, long size)
    1.17 +{
    1.18 +	BUG_ON((unsigned)size > PAGE_SIZE);
    1.19 +
    1.20 +	if (VMX_DOMAIN(current)) {
    1.21 +		if (is_virtual_mode(current)) {
    1.22 +			thash_data_t *data;
    1.23 +			unsigned long gpa, poff;
    1.24 +
    1.25 +			/* The caller must provide a DTR or DTC mapping */
    1.26 +			data = vtlb_lookup(current, to, DSIDE_TLB);
    1.27 +			if (data) {
    1.28 +				gpa = data->page_flags & _PAGE_PPN_MASK;
    1.29 +			} else {
    1.30 +				data = vhpt_lookup(to);
    1.31 +				if (!data)
    1.32 +					return -1;
    1.33 +				gpa = __mpa_to_gpa(
    1.34 +					data->page_flags & _PAGE_PPN_MASK);
    1.35 +				gpa &= _PAGE_PPN_MASK;
    1.36 +			}
    1.37 +			poff = POFFSET(to, data->ps);
    1.38 +			if (poff + size > PSIZE(data->ps))
    1.39 +				return -1;
    1.40 +			to = PAGEALIGN(gpa, data->ps) | poff;
    1.41 +		}
    1.42 +		to |= XENCOMM_INLINE_FLAG;
    1.43 +		if (xencomm_copy_to_guest((void *)to, from, size, 0) != 0)
    1.44 +			return -1;
    1.45 +		return 0;
    1.46 +	} else {
    1.47 +		/* check for vulnerability */
    1.48 +		if (IS_VMM_ADDRESS(to) || IS_VMM_ADDRESS(to + size - 1))
    1.49 +			panic_domain(NULL, "copy to bad address:0x%lx\n", to);
    1.50 +		return copy_to_user((void __user *)to, from, size);
    1.51 +	}
    1.52 +}
    1.53 +
    1.54  cpumask_t cpu_cache_coherent_map;
    1.55  
    1.56  struct cache_flush_args {
    1.57 @@ -805,16 +845,13 @@ xen_pal_emulator(unsigned long index, u6
    1.58  					pm_buffer,
    1.59  					(pal_perf_mon_info_u_t *) &r9);
    1.60  			if (status != 0) {
    1.61 -				while(1)
    1.62  				printk("PAL_PERF_MON_INFO fails ret=%ld\n", status);
    1.63  				break;
    1.64  			}
    1.65 -			if (copy_to_user((void __user *)in1,pm_buffer,128)) {
    1.66 -				while(1)
    1.67 -				printk("xen_pal_emulator: PAL_PERF_MON_INFO "
    1.68 -					"can't copy to user!!!!\n");
    1.69 -				status = PAL_STATUS_UNIMPLEMENTED;
    1.70 -				break;
    1.71 +			if (safe_copy_to_guest(
    1.72 +				in1, pm_buffer, sizeof(pm_buffer))) {
    1.73 +				status = PAL_STATUS_EINVAL;
    1.74 +				goto fail_to_copy;
    1.75  			}
    1.76  		}
    1.77  		break;
    1.78 @@ -837,10 +874,11 @@ xen_pal_emulator(unsigned long index, u6
    1.79  		       consumes 10 mW, implemented and cache/TLB coherent.  */
    1.80  		    unsigned long res = 1000UL | (1000UL << 16) | (10UL << 32)
    1.81  			    | (1UL << 61) | (1UL << 60);
    1.82 -		    if (copy_to_user ((void *)in1, &res, sizeof (res)))
    1.83 +		    if (safe_copy_to_guest (in1, &res, sizeof (res))) {
    1.84  			    status = PAL_STATUS_EINVAL;    
    1.85 -		    else
    1.86 -			    status = PAL_STATUS_SUCCESS;
    1.87 +			    goto fail_to_copy;
    1.88 +		    }
    1.89 +		    status = PAL_STATUS_SUCCESS;
    1.90  	        }
    1.91  		break;
    1.92  	    case PAL_HALT:
    1.93 @@ -886,8 +924,13 @@ xen_pal_emulator(unsigned long index, u6
    1.94  		if (in1 == 0) {
    1.95  			char brand_info[128];
    1.96  			status = ia64_pal_get_brand_info(brand_info);
    1.97 -			if (status == PAL_STATUS_SUCCESS)
    1.98 -				copy_to_user((void *)in2, brand_info, 128);
    1.99 +			if (status != PAL_STATUS_SUCCESS)
   1.100 +				break;
   1.101 +			if (safe_copy_to_guest(in2, brand_info,
   1.102 +					       sizeof(brand_info))) {
   1.103 +				status = PAL_STATUS_EINVAL;
   1.104 +				goto fail_to_copy;
   1.105 +			}
   1.106  		} else {
   1.107  			status = PAL_STATUS_EINVAL;
   1.108  		}
   1.109 @@ -902,6 +945,12 @@ xen_pal_emulator(unsigned long index, u6
   1.110  		break;
   1.111  	}
   1.112  	return ((struct ia64_pal_retval) {status, r9, r10, r11});
   1.113 +
   1.114 +fail_to_copy:
   1.115 +	gdprintk(XENLOG_WARNING,
   1.116 +		"PAL(%ld) fail to copy!!! args 0x%lx 0x%lx 0x%lx\n",
   1.117 +		index, in1, in2, in3);
   1.118 +	return ((struct ia64_pal_retval) {status, r9, r10, r11});
   1.119  }
   1.120  
   1.121  // given a current domain (virtual or metaphysical) address, return the virtual address