Mailing List Archive

commit 1166467ed300d605529aaf7a7d26c8c92defe36a
Author: Bjoern Doebel <doebel@amazon.de>
AuthorDate: Wed Mar 27 17:31:38 2024 +0000
Commit: Andrew Cooper <andrew.cooper3@citrix.com>
CommitDate: Fri Apr 5 15:44:49 2024 +0100

hypercall_xlat_continuation: Replace BUG_ON with domain_crash

Instead of crashing the host in case of unexpected hypercall parameters,
resort to only crashing the calling domain.

This is part of XSA-454 / CVE-2023-46842.

Fixes: b8a7efe8528a ("Enable compatibility mode operation for HYPERVISOR_memory_op")
Reported-by: Manuel Andreas <manuel.andreas@tum.de>
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
(cherry picked from commit 9926e692c4afc40bcd66f8416ff6a1e93ce402f6)
---
xen/arch/x86/hypercall.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
index 01cd73040d..04b5e9874c 100644
--- a/xen/arch/x86/hypercall.c
+++ b/xen/arch/x86/hypercall.c
@@ -140,8 +140,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned int nr,
cval = va_arg(args, unsigned int);
if ( cval == nval )
mask &= ~1U;
- else
- BUG_ON(nval == (unsigned int)nval);
+ else if ( nval == (unsigned int)nval )
+ domain_crash(current->domain,
+ "multicall (op %lu) bogus continuation arg%u (%#lx)\n",
+ mcs->call.op, i, nval);
}
else if ( id && *id == i )
{
@@ -153,8 +155,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned int nr,
mcs->call.args[i] = cval;
++rc;
}
- else
- BUG_ON(mcs->call.args[i] != (unsigned int)mcs->call.args[i]);
+ else if ( mcs->call.args[i] != (unsigned int)mcs->call.args[i] )
+ domain_crash(current->domain,
+ "multicall (op %lu) bad continuation arg%u (%#lx)\n",
+ mcs->call.op, i, mcs->call.args[i]);
}
}
else
@@ -180,8 +184,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned int nr,
cval = va_arg(args, unsigned int);
if ( cval == nval )
mask &= ~1U;
- else
- BUG_ON(nval == (unsigned int)nval);
+ else if ( nval == (unsigned int)nval )
+ domain_crash(current->domain,
+ "hypercall (op %u) bogus continuation arg%u (%#lx)\n",
+ regs->eax, i, nval);
}
else if ( id && *id == i )
{
@@ -193,8 +199,10 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned int nr,
*reg = cval;
++rc;
}
- else
- BUG_ON(*reg != (unsigned int)*reg);
+ else if ( *reg != (unsigned int)*reg )
+ domain_crash(current->domain,
+ "hypercall (op %u) bad continuation arg%u (%#lx)\n",
+ regs->eax, i, *reg);
}
}

--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18