head 1.2; access; symbols pkgsrc-2020Q3:1.1.0.2; locks; strict; comment @# @; 1.2 date 2020.11.06.21.45.49; author bouyer; state dead; branches; next 1.1; commitid WDPVMlrHGXeceSuC; 1.1 date 2020.10.01.12.41.19; author bouyer; state Exp; branches 1.1.2.1; next ; commitid t8BQtD5cJssqocqC; 1.1.2.1 date 2020.10.01.12.41.19; author bsiegert; state dead; branches; next 1.1.2.2; commitid 6fMH1kUIpq0AYCqC; 1.1.2.2 date 2020.10.04.20.44.32; author bsiegert; state Exp; branches; next ; commitid 6fMH1kUIpq0AYCqC; desc @@ 1.2 log @Update xenkernel413 and xentools413 to 4.13.2. This includes fixes for XSA up to XSA347, and an improved fix for XSA 286. @ text @$NetBSD: patch-XSA334,v 1.1 2020/10/01 12:41:19 bouyer Exp $ From: Andrew Cooper Subject: xen/memory: Don't skip the RCU unlock path in acquire_resource() In the case that an HVM Stubdomain makes an XENMEM_acquire_resource hypercall, the FIXME path will bypass rcu_unlock_domain() on the way out of the function. Move the check to the start of the function. This does change the behaviour of the get-size path for HVM Stubdomains, but that functionality is currently broken and unused anyway, as well as being quite useless to entities which can't actually map the resource anyway. This is XSA-334. Fixes: 83fa6552ce ("common: add a new mappable resource type: XENMEM_resource_grant_table") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich diff --git a/xen/common/memory.c b/xen/common/memory.c index 1a3c9ffb30..29741d8904 100644 --- xen/common/memory.c.orig +++ xen/common/memory.c @@@@ -1058,6 +1058,14 @@@@ static int acquire_resource( xen_pfn_t mfn_list[32]; int rc; + /* + * FIXME: Until foreign pages inserted into the P2M are properly + * reference counted, it is unsafe to allow mapping of + * resource pages unless the caller is the hardware domain. + */ + if ( paging_mode_translate(currd) && !is_hardware_domain(currd) ) + return -EACCES; + if ( copy_from_guest(&xmar, arg, 1) ) return -EFAULT; @@@@ -1114,14 +1122,6 @@@@ static int acquire_resource( xen_pfn_t gfn_list[ARRAY_SIZE(mfn_list)]; unsigned int i; - /* - * FIXME: Until foreign pages inserted into the P2M are properly - * reference counted, it is unsafe to allow mapping of - * resource pages unless the caller is the hardware domain. - */ - if ( !is_hardware_domain(currd) ) - return -EACCES; - if ( copy_from_guest(gfn_list, xmar.frame_list, xmar.nr_frames) ) rc = -EFAULT; @ 1.1 log @Add uptream fixes for XSA333, XSA334, XSA336, XSA337, XSA338, XSA339, XSA340, XSA342, XSA343, XSA344 bump PKGREVISION @ text @d1 1 a1 1 $NetBSD: $ @ 1.1.2.1 log @file patch-XSA334 was added on branch pkgsrc-2020Q3 on 2020-10-04 20:44:32 +0000 @ text @d1 53 @ 1.1.2.2 log @Pullup ticket #6332 - requested by bouyer sysutils/xenkernel411: security fix sysutils/xenkernel413: security fix Revisions pulled up: - sysutils/xenkernel411/Makefile 1.16 - sysutils/xenkernel411/distinfo 1.14 - sysutils/xenkernel411/patches/patch-XSA333 1.1 - sysutils/xenkernel411/patches/patch-XSA336 1.1 - sysutils/xenkernel411/patches/patch-XSA337 1.1 - sysutils/xenkernel411/patches/patch-XSA338 1.1 - sysutils/xenkernel411/patches/patch-XSA339 1.1 - sysutils/xenkernel411/patches/patch-XSA340 1.1 - sysutils/xenkernel411/patches/patch-XSA342 1.1 - sysutils/xenkernel411/patches/patch-XSA343 1.1 - sysutils/xenkernel411/patches/patch-XSA344 1.1 - sysutils/xenkernel413/Makefile 1.5 - sysutils/xenkernel413/distinfo 1.3 - sysutils/xenkernel413/patches/patch-XSA333 1.1 - sysutils/xenkernel413/patches/patch-XSA334 1.1 - sysutils/xenkernel413/patches/patch-XSA336 1.1 - sysutils/xenkernel413/patches/patch-XSA337 1.1 - sysutils/xenkernel413/patches/patch-XSA338 1.1 - sysutils/xenkernel413/patches/patch-XSA339 1.1 - sysutils/xenkernel413/patches/patch-XSA340 1.1 - sysutils/xenkernel413/patches/patch-XSA342 1.1 - sysutils/xenkernel413/patches/patch-XSA343 1.1 - sysutils/xenkernel413/patches/patch-XSA344 1.1 --- Module Name: pkgsrc Committed By: bouyer Date: Thu Oct 1 12:41:19 UTC 2020 Modified Files: pkgsrc/sysutils/xenkernel413: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel413/patches: patch-XSA333 patch-XSA334 patch-XSA336 patch-XSA337 patch-XSA338 patch-XSA339 patch-XSA340 patch-XSA342 patch-XSA343 patch-XSA344 Log Message: Add uptream fixes for XSA333, XSA334, XSA336, XSA337, XSA338, XSA339, XSA340, XSA342, XSA343, XSA344 bump PKGREVISION --- Module Name: pkgsrc Committed By: bouyer Date: Fri Oct 2 13:00:48 UTC 2020 Modified Files: pkgsrc/sysutils/xenkernel411: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel411/patches: patch-XSA333 patch-XSA336 patch-XSA337 patch-XSA338 patch-XSA339 patch-XSA340 patch-XSA342 patch-XSA343 patch-XSA344 Log Message: dd uptream fixes for XSA333, XSA336, XSA337, XSA338, XSA339, XSA340, XSA342, XSA343, XSA344 bump PKGREVISION @ text @a0 53 $NetBSD: patch-XSA334,v 1.1 2020/10/01 12:41:19 bouyer Exp $ From: Andrew Cooper Subject: xen/memory: Don't skip the RCU unlock path in acquire_resource() In the case that an HVM Stubdomain makes an XENMEM_acquire_resource hypercall, the FIXME path will bypass rcu_unlock_domain() on the way out of the function. Move the check to the start of the function. This does change the behaviour of the get-size path for HVM Stubdomains, but that functionality is currently broken and unused anyway, as well as being quite useless to entities which can't actually map the resource anyway. This is XSA-334. Fixes: 83fa6552ce ("common: add a new mappable resource type: XENMEM_resource_grant_table") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich diff --git a/xen/common/memory.c b/xen/common/memory.c index 1a3c9ffb30..29741d8904 100644 --- xen/common/memory.c.orig +++ xen/common/memory.c @@@@ -1058,6 +1058,14 @@@@ static int acquire_resource( xen_pfn_t mfn_list[32]; int rc; + /* + * FIXME: Until foreign pages inserted into the P2M are properly + * reference counted, it is unsafe to allow mapping of + * resource pages unless the caller is the hardware domain. + */ + if ( paging_mode_translate(currd) && !is_hardware_domain(currd) ) + return -EACCES; + if ( copy_from_guest(&xmar, arg, 1) ) return -EFAULT; @@@@ -1114,14 +1122,6 @@@@ static int acquire_resource( xen_pfn_t gfn_list[ARRAY_SIZE(mfn_list)]; unsigned int i; - /* - * FIXME: Until foreign pages inserted into the P2M are properly - * reference counted, it is unsafe to allow mapping of - * resource pages unless the caller is the hardware domain. - */ - if ( !is_hardware_domain(currd) ) - return -EACCES; - if ( copy_from_guest(gfn_list, xmar.frame_list, xmar.nr_frames) ) rc = -EFAULT; @