From 545607eb3cfeb2abf5742d1bb869734f317fcfe5 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 18 Apr 2013 16:11:23 +0200 Subject: x86: fix various issues with handling guest IRQs - properly revoke IRQ access in map_domain_pirq() error path - don't permit replacing an in use IRQ - don't accept inputs in the GSI range for MAP_PIRQ_TYPE_MSI - track IRQ access permission in host IRQ terms, not guest IRQ ones (and with that, also disallow Dom0 access to IRQ0) This is CVE-2013-1919 / XSA-46. Signed-off-by: Jan Beulich Acked-by: Stefano Stabellini --- xen/common/event_channel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'xen/common/event_channel.c') diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index 0a6684c6d5..64c976b20a 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -369,7 +369,7 @@ static long evtchn_bind_pirq(evtchn_bind_pirq_t *bind) if ( (pirq < 0) || (pirq >= d->nr_pirqs) ) return -EINVAL; - if ( !is_hvm_domain(d) && !irq_access_permitted(d, pirq) ) + if ( !is_hvm_domain(d) && !pirq_access_permitted(d, pirq) ) return -EPERM; spin_lock(&d->event_lock); -- cgit v1.2.3