diff options
| author | Jan Beulich <jbeulich@suse.com> | 2013-08-20 16:10:44 +0200 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-08-20 16:10:44 +0200 |
| commit | 7c2dc5b8e80234153e7aaa32b9a511d0738bd39e (patch) | |
| tree | 84609c9bddd50a998983a504681b8005f2cc8a1d | |
| parent | bfe2b5abd6871ee250cf01d07f23b177700932bc (diff) | |
| download | xen-7c2dc5b8e80234153e7aaa32b9a511d0738bd39e.tar.gz xen-7c2dc5b8e80234153e7aaa32b9a511d0738bd39e.tar.bz2 xen-7c2dc5b8e80234153e7aaa32b9a511d0738bd39e.zip | |
VT-d: protect against bogus information coming from BIOS
Add checks similar to those done by Linux: The DRHD address must not
be all zeros or all ones (Linux only checks for zero), and capabilities
as well as extended capabilities must not be all ones.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Ben Guthro <benjamin.guthro@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Tested-by: Ben Guthro <benjamin.guthro@citrix.com>
Acked by: Yang Zhang <yang.z.zhang@intel.com>
Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>
master commit: e8e8b030ecf916fea19639f0b6a446c1c9dbe174
master date: 2013-08-14 11:18:24 +0200
| -rw-r--r-- | xen/drivers/passthrough/vtd/dmar.c | 3 | ||||
| -rw-r--r-- | xen/drivers/passthrough/vtd/iommu.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 5ecade2657..0f117b1789 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -400,6 +400,9 @@ acpi_parse_one_drhd(struct acpi_dmar_entry_header *header) if ( (ret = acpi_dmar_check_length(header, sizeof(*drhd))) != 0 ) return ret; + if ( !drhd->address || !(drhd->address + 1) ) + return -ENODEV; + dmaru = xmalloc(struct acpi_drhd_unit); if ( !dmaru ) return -ENOMEM; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index bbfcf2a893..c243287908 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1182,6 +1182,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd) dprintk(VTDPREFIX, "cap = %"PRIx64" ecap = %"PRIx64"\n", iommu->cap, iommu->ecap); } + if ( !(iommu->cap + 1) || !(iommu->ecap + 1) ) + return -ENODEV; + if ( cap_fault_reg_offset(iommu->cap) + cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_REG_LEN >= PAGE_SIZE || ecap_iotlb_offset(iommu->ecap) >= PAGE_SIZE ) |