Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 440628 Details for
Bug 588780
<app-emulation/xen{,-tools}-4.6.3-r1, <app-emulation/xen-pvgrub-4.6.3: Multiple vulnerabilities (CVE-2016-6258)
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
xsa182-unstable.patch
xsa182-unstable.patch (text/plain), 4.17 KB, created by
Aaron Bauman (RETIRED)
on 2016-07-13 19:40:25 UTC
(
hide
)
Description:
xsa182-unstable.patch
Filename:
MIME Type:
Creator:
Aaron Bauman (RETIRED)
Created:
2016-07-13 19:40:25 UTC
Size:
4.17 KB
patch
obsolete
>From 00593655e231ed5ea20704120037026e33b83fbb Mon Sep 17 00:00:00 2001 >From: Andrew Cooper <andrew.cooper3@citrix.com> >Date: Mon, 11 Jul 2016 14:32:03 +0100 >Subject: [PATCH] x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath > >All changes in writeability and cacheability must go through full >re-validation. > >Rework the logic as a whitelist, to make it clearer to follow. > >This is XSA-182 > >Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> >Reviewed-by: Tim Deegan <tim@xen.org> >--- > xen/arch/x86/mm.c | 28 ++++++++++++++++------------ > xen/include/asm-x86/page.h | 1 + > 2 files changed, 17 insertions(+), 12 deletions(-) > >diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c >index dbcf6cb..56ca19f 100644 >--- a/xen/arch/x86/mm.c >+++ b/xen/arch/x86/mm.c >@@ -1852,6 +1852,14 @@ static inline int update_intpte(intpte_t *p, > _t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \ > (_m), (_v), (_ad)) > >+/* >+ * PTE flags that a guest may change without re-validating the PTE. >+ * All other bits affect translation, caching, or Xen's safety. >+ */ >+#define FASTPATH_FLAG_WHITELIST \ >+ (_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \ >+ _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER) >+ > /* Update the L1 entry at pl1e to new value nl1e. */ > static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e, > unsigned long gl1mfn, int preserve_ad, >@@ -1891,9 +1899,8 @@ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e, > nl1e = l1e_from_pfn(page_to_mfn(page), l1e_get_flags(nl1e)); > } > >- /* Fast path for identical mapping, r/w, presence, and cachability. */ >- if ( !l1e_has_changed(ol1e, nl1e, >- PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) ) >+ /* Fast path for sufficiently-similar mappings. */ >+ if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) ) > { > adjust_guest_l1e(nl1e, pt_dom); > rc = UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu, >@@ -1970,11 +1977,8 @@ static int mod_l2_entry(l2_pgentry_t *pl2e, > return -EINVAL; > } > >- /* Fast path for identical mapping and presence. */ >- if ( !l2e_has_changed(ol2e, nl2e, >- unlikely(opt_allow_superpage) >- ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT >- : _PAGE_PRESENT) ) >+ /* Fast path for sufficiently-similar mappings. */ >+ if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) ) > { > adjust_guest_l2e(nl2e, d); > if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) ) >@@ -2039,8 +2043,8 @@ static int mod_l3_entry(l3_pgentry_t *pl3e, > return -EINVAL; > } > >- /* Fast path for identical mapping and presence. */ >- if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) ) >+ /* Fast path for sufficiently-similar mappings. */ >+ if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) ) > { > adjust_guest_l3e(nl3e, d); > rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad); >@@ -2103,8 +2107,8 @@ static int mod_l4_entry(l4_pgentry_t *pl4e, > return -EINVAL; > } > >- /* Fast path for identical mapping and presence. */ >- if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) ) >+ /* Fast path for sufficiently-similar mappings. */ >+ if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) ) > { > adjust_guest_l4e(nl4e, d); > rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad); >diff --git a/xen/include/asm-x86/page.h b/xen/include/asm-x86/page.h >index 224852a..4ae387f 100644 >--- a/xen/include/asm-x86/page.h >+++ b/xen/include/asm-x86/page.h >@@ -313,6 +313,7 @@ void efi_update_l4_pgtable(unsigned int l4idx, l4_pgentry_t); > #define _PAGE_AVAIL2 _AC(0x800,U) > #define _PAGE_AVAIL _AC(0xE00,U) > #define _PAGE_PSE_PAT _AC(0x1000,U) >+#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12) > #define _PAGE_NX (cpu_has_nx ? _PAGE_NX_BIT : 0) > /* non-architectural flags */ > #define _PAGE_PAGED 0x2000U >-- >2.1.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 588780
:
440622
|
440624
| 440628 |
440630
|
440632