Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-08-14 19:51:27 +0200
committerTakashi Iwai <tiwai@suse.de>2018-08-14 19:51:27 +0200
commit28574e6de5a2c9dfaab3b3e3f975219f7e404c5c (patch)
tree25249582e944eb6de50b8fd2ecb05b2a91811720
parentc79f02f1ec22d240c0c4d32207377b875eb12ebb (diff)
parent7af0f9cdcc729ace008f35b46480d9d0a0e5991b (diff)
Merge branch 'SLE15_EMBARGO' into openSUSE-15.0_EMBARGOrpm-4.12.14-lp150.12.16--15.0-updatesrpm-4.12.14-lp150.12.16
-rw-r--r--patches.fixes/xen-xsa270-fix.patch56
-rw-r--r--series.conf1
2 files changed, 57 insertions, 0 deletions
diff --git a/patches.fixes/xen-xsa270-fix.patch b/patches.fixes/xen-xsa270-fix.patch
new file mode 100644
index 0000000000..af35b18ef7
--- /dev/null
+++ b/patches.fixes/xen-xsa270-fix.patch
@@ -0,0 +1,56 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: xen-netback: fix input validation in xenvif_set_hash_mapping()
+Patch-mainline: Not yet, embargo
+References: bnc#1103277
+
+Both len and off are frontend specified values, so we need to make
+sure there's no overflow when adding the two for the bounds check. We
+also want to avoid undefined behavior and hence use off to index into
+->hash.mapping[] only after bounds checking. This at the same time
+allows to take care of not applying off twice for the bounds checking
+against vif->num_queues.
+
+It is also insufficient to bounds check copy_op.len, as this is len
+truncated to 16 bits.
+
+This is XSA-270.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
+Tested-by: Paul Durrant <paul.durrant@citrix.com>
+---
+The bounds checking against vif->num_queues also occurs too early afaict
+(it should be done after the grant copy). I have patches ready as public
+follow-ups for both this and the (at least latent) issue of the mapping
+array crossing a page boundary.
+
+--- a/drivers/net/xen-netback/hash.c
++++ b/drivers/net/xen-netback/hash.c
+@@ -332,20 +332,22 @@ u32 xenvif_set_hash_mapping_size(struct
+ u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len,
+ u32 off)
+ {
+- u32 *mapping = &vif->hash.mapping[off];
++ u32 *mapping = vif->hash.mapping;
+ struct gnttab_copy copy_op = {
+ .source.u.ref = gref,
+ .source.domid = vif->domid,
+- .dest.u.gmfn = virt_to_gfn(mapping),
+ .dest.domid = DOMID_SELF,
+- .dest.offset = xen_offset_in_page(mapping),
+- .len = len * sizeof(u32),
++ .len = len * sizeof(*mapping),
+ .flags = GNTCOPY_source_gref
+ };
+
+- if ((off + len > vif->hash.size) || copy_op.len > XEN_PAGE_SIZE)
++ if ((off + len < off) || (off + len > vif->hash.size) ||
++ len > XEN_PAGE_SIZE / sizeof(*mapping))
+ return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+
++ copy_op.dest.u.gmfn = virt_to_gfn(mapping + off);
++ copy_op.dest.offset = xen_offset_in_page(mapping + off);
++
+ while (len-- != 0)
+ if (mapping[off++] >= vif->num_queues)
+ return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
diff --git a/series.conf b/series.conf
index f67d03b3c3..581fe1b8ec 100644
--- a/series.conf
+++ b/series.conf
@@ -16273,6 +16273,7 @@
# out-of-tree patches
patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch
+ patches.fixes/xen-xsa270-fix.patch
########################################################
# end of sorted patches