|
 |
eb52691 |
From: Jan Beulich <jbeulich@suse.com>
|
|
|
eb52691 |
Subject: x86/HVM: prefill partially used variable on emulation paths
|
|
|
eb52691 |
|
|
|
eb52691 |
Certain handlers ignore the access size (vioapic_write() being the
|
|
|
eb52691 |
example this was found with), perhaps leading to subsequent reads
|
|
|
eb52691 |
seeing data that wasn't actually written by the guest. For
|
|
|
eb52691 |
consistency and extra safety also do this on the read path of
|
|
|
eb52691 |
hvm_process_io_intercept(), even if this doesn't directly affect what
|
|
|
eb52691 |
guests get to see, as we've supposedly already dealt with read handlers
|
|
|
eb52691 |
leaving data completely unitialized.
|
|
|
eb52691 |
|
|
|
eb52691 |
This is XSA-239.
|
|
|
eb52691 |
|
|
|
eb52691 |
Reported-by: Roger Pau Monné <roger.pau@citrix.com>
|
|
|
eb52691 |
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
|
|
|
eb52691 |
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
|
eb52691 |
|
|
|
eb52691 |
--- a/xen/arch/x86/hvm/emulate.c
|
|
|
eb52691 |
+++ b/xen/arch/x86/hvm/emulate.c
|
|
|
eb52691 |
@@ -129,7 +129,7 @@ static int hvmemul_do_io(
|
|
|
eb52691 |
.count = *reps,
|
|
|
eb52691 |
.dir = dir,
|
|
|
eb52691 |
.df = df,
|
|
|
eb52691 |
- .data = data,
|
|
|
eb52691 |
+ .data = data_is_addr ? data : 0,
|
|
|
eb52691 |
.data_is_ptr = data_is_addr, /* ioreq_t field name is misleading */
|
|
|
eb52691 |
.state = STATE_IOREQ_READY,
|
|
|
eb52691 |
};
|
|
|
eb52691 |
--- a/xen/arch/x86/hvm/intercept.c
|
|
|
eb52691 |
+++ b/xen/arch/x86/hvm/intercept.c
|
|
|
eb52691 |
@@ -127,6 +127,7 @@ int hvm_process_io_intercept(const struc
|
|
|
eb52691 |
addr = (p->type == IOREQ_TYPE_COPY) ?
|
|
|
eb52691 |
p->addr + step * i :
|
|
|
eb52691 |
p->addr;
|
|
|
eb52691 |
+ data = 0;
|
|
|
eb52691 |
rc = ops->read(handler, addr, p->size, &data);
|
|
|
eb52691 |
if ( rc != X86EMUL_OKAY )
|
|
|
eb52691 |
break;
|
|
|
eb52691 |
@@ -161,6 +162,7 @@ int hvm_process_io_intercept(const struc
|
|
|
eb52691 |
{
|
|
|
eb52691 |
if ( p->data_is_ptr )
|
|
|
eb52691 |
{
|
|
|
eb52691 |
+ data = 0;
|
|
|
eb52691 |
switch ( hvm_copy_from_guest_phys(&data, p->data + step * i,
|
|
|
eb52691 |
p->size) )
|
|
|
eb52691 |
{
|