diff options
author | Jan Beulich <jbeulich@suse.com> | 2013-04-18 16:11:23 +0200 |
---|---|---|
committer | Jan Beulich <jbeulich@suse.com> | 2013-04-18 16:11:23 +0200 |
commit | 545607eb3cfeb2abf5742d1bb869734f317fcfe5 (patch) | |
tree | 6039c103db155c2f36625ffd75d7262d5dfdc5c4 /tools/python/xen | |
parent | fdac9515607b757c044e7ef0d61b1453ef999b08 (diff) | |
download | xen-545607eb3cfeb2abf5742d1bb869734f317fcfe5.tar.gz xen-545607eb3cfeb2abf5742d1bb869734f317fcfe5.tar.bz2 xen-545607eb3cfeb2abf5742d1bb869734f317fcfe5.zip |
x86: fix various issues with handling guest IRQs
- properly revoke IRQ access in map_domain_pirq() error path
- don't permit replacing an in use IRQ
- don't accept inputs in the GSI range for MAP_PIRQ_TYPE_MSI
- track IRQ access permission in host IRQ terms, not guest IRQ ones
(and with that, also disallow Dom0 access to IRQ0)
This is CVE-2013-1919 / XSA-46.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Diffstat (limited to 'tools/python/xen')
-rw-r--r-- | tools/python/xen/xend/server/irqif.py | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/tools/python/xen/xend/server/irqif.py b/tools/python/xen/xend/server/irqif.py index ae0b1ff4b6..723f34652a 100644 --- a/tools/python/xen/xend/server/irqif.py +++ b/tools/python/xen/xend/server/irqif.py @@ -73,6 +73,12 @@ class IRQController(DevController): pirq = get_param('irq') + rc = xc.physdev_map_pirq(domid = self.getDomid(), + index = pirq, + pirq = pirq) + if rc < 0: + raise VmError('irq: Failed to map irq %x' % (pirq)) + rc = xc.domain_irq_permission(domid = self.getDomid(), pirq = pirq, allow_access = True) @@ -81,12 +87,6 @@ class IRQController(DevController): #todo non-fatal raise VmError( 'irq: Failed to configure irq: %d' % (pirq)) - rc = xc.physdev_map_pirq(domid = self.getDomid(), - index = pirq, - pirq = pirq) - if rc < 0: - raise VmError( - 'irq: Failed to map irq %x' % (pirq)) back = dict([(k, config[k]) for k in self.valid_cfg if k in config]) return (self.allocateDeviceID(), back, {}) |