]> xenbits.xensource.com Git - xen.git/commit
x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server...
authorVitaly Kuznetsov <vkuznets@redhat.com>
Tue, 5 Sep 2017 11:41:37 +0000 (13:41 +0200)
committerJan Beulich <jbeulich@suse.com>
Thu, 12 Oct 2017 12:43:02 +0000 (14:43 +0200)
commitd59e55b018cfb79d0c4f794041aff4fe1cd0d570
tree48bbbfaac6731265f2b3d412ad26f424f401e647
parent6f17f5c43a3bd28d27ed8133b2bf513e2eab7d59
x86/ioreq server: correctly handle bogus XEN_DMOP_{,un}map_io_range_to_ioreq_server arguments

Misbehaving device model can pass incorrect XEN_DMOP_map/
unmap_io_range_to_ioreq_server arguments, namely end < start when
specifying address range. When this happens we hit ASSERT(s <= e) in
rangeset_contains_range()/rangeset_overlaps_range() with debug builds.
Production builds will not trap right away but may misbehave later
while handling such bogus ranges.

This is XSA-238.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/hvm/ioreq.c