File 61efec96-IOMMU-x86-stop-pirq-iteration-immediat... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 61efec96-IOMMU-x86-stop-pirq-iteration-immediately-on-error.patch of Package xen (Revision 1bdcc57c93f93b1ab6eb9bcadb5039d3)

Currently displaying revision 1bdcc57c93f93b1ab6eb9bcadb5039d3 , Show latest

# Commit 9480a1a519cf016623f657dc544cb372a82b5708
# Date 2022-01-25 13:27:02 +0100
# Author Julien Grall <jgrall@amazon.com>
# Committer Jan Beulich <jbeulich@suse.com>
passthrough/x86: stop pirq iteration immediately in case of error

pt_pirq_iterate() will iterate in batch over all the PIRQs. The outer
loop will bail out if 'rc' is non-zero but the inner loop will continue.

This means 'rc' will get clobbered and we may miss any errors (such as
-ERESTART in the case of the callback pci_clean_dpci_irq()).

This is CVE-2022-23035 / XSA-395.

Fixes: c24536b636f2 ("replace d->nr_pirqs sized arrays with radix tree")
Fixes: f6dd295381f4 ("dpci: replace tasklet with softirq")
Signed-off-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

--- a/xen/drivers/passthrough/x86/hvm.c
+++ b/xen/drivers/passthrough/x86/hvm.c
@@ -732,7 +732,11 @@ int pt_pirq_iterate(struct domain *d,
 
             pirq = pirqs[i]->pirq;
             if ( (pirq_dpci->flags & HVM_IRQ_DPCI_MAPPED) )
+            {
                 rc = cb(d, pirq_dpci, arg);
+                if ( rc )
+                    break;
+            }
         }
     } while ( !rc && ++pirq < d->nr_pirqs && n == ARRAY_SIZE(pirqs) );

Places

File 61efec96-IOMMU-x86-stop-pirq-iteration-immediately-on-error.patch of Package xen (Revision 1bdcc57c93f93b1ab6eb9bcadb5039d3)

Places