From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 18 Nov 2014 13:32:57 +0000 (+0100)
Subject: x86: don't allow page table updates on non-PV page tables in do_mmu_update()
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=6791ab169fe6b2cd7c69a5140cd229d036e706b0;p=xen.git

x86: don't allow page table updates on non-PV page tables in do_mmu_update()

paging_write_guest_entry() and paging_cmpxchg_guest_entry() aren't
consistently supported for non-PV guests (they'd deref NULL for PVH or
non-HAP HVM ones). Don't allow respective MMU_* operations on the
page tables of such domains.

This is CVE-2014-8594 / XSA-109.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
---

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 9ec617b110..121aef4bbd 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3794,6 +3794,10 @@ long do_mmu_update(
         {
             p2m_type_t p2mt;
 
+            rc = -EOPNOTSUPP;
+            if ( unlikely(paging_mode_refcounts(pt_owner)) )
+                break;
+
             rc = xsm_mmu_normal_update(d, pt_owner, pg_owner, req.val);
             if ( rc )
                 break;