From patchwork Wed Mar 30 11:25:18 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Durrant X-Patchwork-Id: 8695431 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C9F08C0553 for ; Wed, 30 Mar 2016 11:39:13 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E7FA92037F for ; Wed, 30 Mar 2016 11:39:12 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0684320361 for ; Wed, 30 Mar 2016 11:39:12 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1alEQL-00031h-LK; Wed, 30 Mar 2016 11:36:33 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1alEQK-00031b-Mf for xen-devel@lists.xenproject.org; Wed, 30 Mar 2016 11:36:32 +0000 Received: from [85.158.137.68] by server-16.bemta-3.messagelabs.com id CE/FC-02994-F3ABBF65; Wed, 30 Mar 2016 11:36:31 +0000 X-Env-Sender: prvs=890aa2445=Paul.Durrant@citrix.com X-Msg-Ref: server-2.tower-31.messagelabs.com!1459337789!32052474!1 X-Originating-IP: [66.165.176.89] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni44OSA9PiAyMDMwMDc=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 8.11; banners=-,-,- X-VirusChecked: Checked Received: (qmail 17668 invoked from network); 30 Mar 2016 11:36:31 -0000 Received: from smtp.citrix.com (HELO SMTP.CITRIX.COM) (66.165.176.89) by server-2.tower-31.messagelabs.com with RC4-SHA encrypted SMTP; 30 Mar 2016 11:36:31 -0000 X-IronPort-AV: E=Sophos;i="5.24,415,1454976000"; d="scan'208";a="343369402" From: Paul Durrant To: Date: Wed, 30 Mar 2016 12:25:18 +0100 Message-ID: <1459337118-3458-1-git-send-email-paul.durrant@citrix.com> X-Mailer: git-send-email 2.1.4 MIME-Version: 1.0 X-DLP: MIA1 Cc: Andrew Cooper , Paul Durrant , Keir Fraser , Jan Beulich Subject: [Xen-devel] [PATCH v2] x86/hvm/viridian: zero and check vcpu context __pad field X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 57844631 "save APIC assist vector" added an extra field to the viridian vcpu context save record. This field was only a uint8_t and so an extra __pad field was also added to pad up to the next 64-bit boundary. This patch makes sure that __pad field is zeroed on save and checked for zero on restore. This prevents a potential leak of information from the stack and a compatibility check against future use of the space occupied by the __pad field. This patch also adds a memset to make sure that the viridian domain context is fully zeroed. This is not strictly necessary but helps make the code more robust if fields are added to that struct in future. Signed-off-by: Paul Durrant Cc: Keir Fraser Cc: Jan Beulich Cc: Andrew Cooper --- v2: - drop is_zero() helper an use memcmp against zero_page instead. - add memset to viridian_save_domain_ctxt() to reduce potential for information leakage in future. --- xen/arch/x86/hvm/viridian.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/xen/arch/x86/hvm/viridian.c b/xen/arch/x86/hvm/viridian.c index 5c76c1a..165f58e 100644 --- a/xen/arch/x86/hvm/viridian.c +++ b/xen/arch/x86/hvm/viridian.c @@ -785,6 +785,8 @@ static int viridian_save_domain_ctxt(struct domain *d, hvm_domain_context_t *h) if ( !is_viridian_domain(d) ) return 0; + memset(&ctxt, 0, sizeof(ctxt)); + ctxt.time_ref_count = d->arch.hvm_domain.viridian.time_ref_count.val; ctxt.hypercall_gpa = d->arch.hvm_domain.viridian.hypercall_gpa.raw; ctxt.guest_os_id = d->arch.hvm_domain.viridian.guest_os_id.raw; @@ -824,6 +826,8 @@ static int viridian_save_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) for_each_vcpu( d, v ) { struct hvm_viridian_vcpu_context ctxt; + memset(&ctxt, 0, sizeof(ctxt)); + ctxt.apic_assist_msr = v->arch.hvm_vcpu.viridian.apic_assist.msr.raw; ctxt.apic_assist_vector = v->arch.hvm_vcpu.viridian.apic_assist.vector; @@ -851,6 +855,9 @@ static int viridian_load_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) if ( hvm_load_entry_zeroextend(VIRIDIAN_VCPU, h, &ctxt) != 0 ) return -EINVAL; + if ( memcmp(&ctxt._pad, zero_page, sizeof(ctxt._pad)) ) + return -EINVAL; + v->arch.hvm_vcpu.viridian.apic_assist.msr.raw = ctxt.apic_assist_msr; if ( v->arch.hvm_vcpu.viridian.apic_assist.msr.fields.enabled ) initialize_apic_assist(v);