x86/mm: PV superpage handling lacks sanity checks

MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before
dereferencing pointers into the superpage frame table.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
get_superpage() has a similar issue.

This is CVE-2016-1570 / XSA-167.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 305686910e9643206c7b7955dd3a344244174266..b81d1fdcdff23ecd79fd3adf19d128d82785fde7 100644 (file)
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -2635,6 +2635,9 @@ int get_superpage(unsigned long mfn, struct domain *d)
 
     ASSERT(opt_allow_superpage);
 
+    if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
+        return -EINVAL;
+
     spage = mfn_to_spage(mfn);
     y = spage->type_info;
     do {
@@ -3432,42 +3435,26 @@ long do_mmuext_op(
         }
 
         case MMUEXT_MARK_SUPER:
+        case MMUEXT_UNMARK_SUPER:
         {
             unsigned long mfn = op.arg1.mfn;
 
-            if ( unlikely(d != pg_owner) )
-                rc = -EPERM;
-            else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
-            {
-                MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
-                rc = -EINVAL;
-            }
-            else if ( !opt_allow_superpage )
+            if ( !opt_allow_superpage )
             {
                 MEM_LOG("Superpages disallowed");
                 rc = -ENOSYS;
             }
-            else
-                rc = mark_superpage(mfn_to_spage(mfn), d);
-            break;
-        }
-
-        case MMUEXT_UNMARK_SUPER:
-        {
-            unsigned long mfn = op.arg1.mfn;
-
-            if ( unlikely(d != pg_owner) )
+            else if ( unlikely(d != pg_owner) )
                 rc = -EPERM;
-            else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
+            else if ( mfn & (L1_PAGETABLE_ENTRIES - 1) )
             {
                 MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
                 rc = -EINVAL;
             }
-            else if ( !opt_allow_superpage )
-            {
-                MEM_LOG("Superpages disallowed");
-                rc = -ENOSYS;
-            }
+            else if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
+                rc = -EINVAL;
+            else if ( op.cmd == MMUEXT_MARK_SUPER )
+                rc = mark_superpage(mfn_to_spage(mfn), d);
             else
                 rc = unmark_superpage(mfn_to_spage(mfn));
             break;