From: Vitaly Kuznetsov Date: Thu, 12 Oct 2017 13:59:15 +0000 (+0200) Subject: x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server... X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=196371c476363a58f236a098ddacd7afefb67f69;p=xen.git x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server arguments Misbehaving device model can pass incorrect XEN_DMOP_map/ unmap_io_range_to_ioreq_server arguments, namely end < start when specifying address range. When this happens we hit ASSERT(s <= e) in rangeset_contains_range()/rangeset_overlaps_range() with debug builds. Production builds will not trap right away but may misbehave later while handling such bogus ranges. This is XSA-238. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Jan Beulich master commit: d59e55b018cfb79d0c4f794041aff4fe1cd0d570 master date: 2017-10-12 14:43:02 +0200 --- diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 4f1c819801..9c965b3edc 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1151,6 +1151,9 @@ static int hvm_map_io_range_to_ioreq_server(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + if ( start > end ) + return -EINVAL; + spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock); rc = -ENOENT; @@ -1202,6 +1205,9 @@ static int hvm_unmap_io_range_from_ioreq_server(struct domain *d, ioservid_t id, struct hvm_ioreq_server *s; int rc; + if ( start > end ) + return -EINVAL; + spin_lock_recursive(&d->arch.hvm_domain.ioreq_server.lock); rc = -ENOENT;