diff options
author | Tim Deegan <tim@xen.org> | 2012-12-04 18:02:38 +0000 |
---|---|---|
committer | Tim Deegan <tim@xen.org> | 2012-12-04 18:02:38 +0000 |
commit | 035f1023c47da339b7f710e32c42571326a7b887 (patch) | |
tree | c02c96c0322274df467cd6605391b0a431ab6cf0 | |
parent | 7e23d7b3687c6e69c4156f5b5d0bb529896e8156 (diff) | |
download | xen-035f1023c47da339b7f710e32c42571326a7b887.tar.gz xen-035f1023c47da339b7f710e32c42571326a7b887.tar.bz2 xen-035f1023c47da339b7f710e32c42571326a7b887.zip |
hvm: Limit the size of large HVM op batches
Doing large p2m updates for HVMOP_track_dirty_vram without preemption
ties up the physical processor. Integrating preemption into the p2m
updates is hard so simply limit to 1GB which is sufficient for a 15000
* 15000 * 32bpp framebuffer.
For HVMOP_modified_memory and HVMOP_set_mem_type preemptible add the
necessary machinery to handle preemption.
This is CVE-2012-5511 / XSA-27.
Signed-off-by: Tim Deegan <tim@xen.org>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
v2: Provide definition of GB to fix x86-32 compile.
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
-rw-r--r-- | xen/arch/x86/hvm/hvm.c | 38 | ||||
-rw-r--r-- | xen/include/asm-x86/config.h | 4 |
2 files changed, 37 insertions, 5 deletions
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 0e9e520f61..7311fdc982 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3969,6 +3969,9 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) if ( !is_hvm_domain(d) ) goto param_fail2; + if ( a.nr > GB(1) >> PAGE_SHIFT ) + goto param_fail2; + rc = xsm_hvm_param(d, op); if ( rc ) goto param_fail2; @@ -3995,7 +3998,6 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) { struct xen_hvm_modified_memory a; struct domain *d; - unsigned long pfn; if ( copy_from_guest(&a, arg, 1) ) return -EFAULT; @@ -4022,9 +4024,11 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) if ( !paging_mode_log_dirty(d) ) goto param_fail3; - for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ ) + while ( a.nr > 0 ) { + unsigned long pfn = a.first_pfn; struct page_info *page; + page = get_page_from_gfn(d, pfn, NULL, P2M_UNSHARE); if ( page ) { @@ -4034,6 +4038,19 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) sh_remove_shadows(d->vcpu[0], _mfn(page_to_mfn(page)), 1, 0); put_page(page); } + + a.first_pfn++; + a.nr--; + + /* Check for continuation if it's not the last interation */ + if ( a.nr > 0 && hypercall_preempt_check() ) + { + if ( copy_to_guest(arg, &a, 1) ) + rc = -EFAULT; + else + rc = -EAGAIN; + break; + } } param_fail3: @@ -4089,7 +4106,6 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) { struct xen_hvm_set_mem_type a; struct domain *d; - unsigned long pfn; /* Interface types to internal p2m types */ p2m_type_t memtype[] = { @@ -4122,8 +4138,9 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) if ( a.hvmmem_type >= ARRAY_SIZE(memtype) ) goto param_fail4; - for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ ) + while ( a.nr ) { + unsigned long pfn = a.first_pfn; p2m_type_t t; p2m_type_t nt; mfn_t mfn; @@ -4163,6 +4180,19 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg) } } put_gfn(d, pfn); + + a.first_pfn++; + a.nr--; + + /* Check for continuation if it's not the last interation */ + if ( a.nr > 0 && hypercall_preempt_check() ) + { + if ( copy_to_guest(arg, &a, 1) ) + rc = -EFAULT; + else + rc = -EAGAIN; + goto param_fail4; + } } rc = 0; diff --git a/xen/include/asm-x86/config.h b/xen/include/asm-x86/config.h index e3e6c32137..7bb5f7da78 100644 --- a/xen/include/asm-x86/config.h +++ b/xen/include/asm-x86/config.h @@ -119,6 +119,9 @@ extern char wakeup_start[]; extern unsigned int video_mode, video_flags; extern unsigned short boot_edid_caps; extern unsigned char boot_edid_info[128]; + +#define GB(_gb) (_gb ## UL << 30) + #endif #define asmlinkage @@ -134,7 +137,6 @@ extern unsigned char boot_edid_info[128]; #define PML4_ADDR(_slot) \ ((((_slot ## UL) >> 8) * 0xffff000000000000UL) | \ (_slot ## UL << PML4_ENTRY_BITS)) -#define GB(_gb) (_gb ## UL << 30) #else #define PML4_ENTRY_BYTES (1 << PML4_ENTRY_BITS) #define PML4_ADDR(_slot) \ |