Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xen for openSUSE:Factory checked in at 2026-09-09 16:19:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xen (Old) and /work/SRC/openSUSE:Factory/.xen.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xen" Wed Sep 9 16:19:10 2026 rev:378 rq:1376391 version:4.22.0_04 Changes: -------- --- /work/SRC/openSUSE:Factory/xen/xen.changes 2026-08-05 17:47:08.227175353 +0200 +++ /work/SRC/openSUSE:Factory/.xen.new.1265/xen.changes 2026-09-09 16:21:30.436916241 +0200 @@ -1,0 +2,13 @@ +Tue Sep 8 06:36:23 MDT 2026 - [email protected] + +- bsc#1276838 - VUL-0: CVE-2026-62437: xen: x86: DMs may cause mem + leak by IRQ binding (XSA-509) + 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch +- bsc#1276839 - VUL-0: CVE-2026-79602: xen: x86: improper handling + of HVM emulation return codes (XSA-510) + 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch +- bsc#1276841 - VUL-0: CVE-2026-79603: xen: unconditionally do TLB + flushing ahead of page scrubbing (XSA-511) + 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch + +------------------------------------------------------------------- New: ---- 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch ----------(New B)---------- New: flushing ahead of page scrubbing (XSA-511) 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch New: of HVM emulation return codes (XSA-510) 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch - bsc#1276841 - VUL-0: CVE-2026-79603: xen: unconditionally do TLB New: leak by IRQ binding (XSA-509) 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch - bsc#1276839 - VUL-0: CVE-2026-79602: xen: x86: improper handling ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xen.spec ++++++ --- /var/tmp/diff_new_pack.PmbGNG/_old 2026-09-09 16:21:32.534003626 +0200 +++ /var/tmp/diff_new_pack.PmbGNG/_new 2026-09-09 16:21:32.536003709 +0200 @@ -126,7 +126,7 @@ BuildRequires: python-rpm-macros Provides: installhint(reboot-needed) -Version: 4.22.0_02 +Version: 4.22.0_04 Release: 0 Summary: Xen Virtualization: Hypervisor (aka VMM aka Microkernel) License: GPL-2.0-only @@ -161,6 +161,9 @@ # For xen-libs Source99: baselibs.conf # Upstream patches +Patch1: 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch +Patch2: 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch +Patch3: 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch # Our platform specific patches Patch400: xen-destdir.patch Patch401: vif-bridge-no-iptables.patch ++++++ 6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch ++++++ Subject: xen/page_alloc: ensure TLB flush is done ahead of page scrubbing From: Roger Pau Monne [email protected] Tue Aug 4 12:23:19 2026 +0200 Date: Wed Aug 26 17:48:17 2026 +0100: Git: 7c95e794d9124b0968e172fe9836f367053d9627 The current way in which idle TLB flush and TLB flushing when allocating a page are done allows for the scrubbing to be done ahead of the TLB flush. A PV domain can still have a TLB entry for the page after scrubbing, and hence it may be able to modify it. Such unintended page accessing allows domains to possibly exchange information even when `xsm=silo scrub-domheap` are in effect. Remove the MEMF_no_tlbflush memory allocation flag, and reorder the flushing so it's always done ahead of the scrubbing in alloc_{,color_}heap_pages(). The sole user of MEMF_no_tlbflush is populate_physmap(), and given the constrains above it's no longer safe to defer the flush, hence the flag removal and the folding of the flush in the allocator function itself. This is XSA-511 / CVE-2026-79603. Fixes: 24f1a58d1954 ("mm: option to _always_ scrub freed domheap pages") Signed-off-by: Roger Pau Monné <[email protected]> Reviewed-by: Jan Beulich <[email protected]> (cherry picked from commit ed7e656e6c18c1f5e6c7d0332fdaa8eeeee1b24e) diff --git a/xen/common/memory.c b/xen/common/memory.c index e245b160d4..ff2ed61fe2 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -232,8 +232,6 @@ static void populate_physmap(struct memop_args *a) unsigned int i, j; xen_pfn_t gpfn; struct domain *d = a->domain, *curr_d = current->domain; - bool need_tlbflush = false; - uint32_t tlbflush_timestamp = 0; if ( !guest_handle_subrange_okay(a->extent_list, a->nr_done, a->nr_extents-1) ) @@ -245,15 +243,6 @@ static void populate_physmap(struct memop_args *a) if ( unlikely(!d->creation_finished) ) { - /* - * With MEMF_no_tlbflush set, alloc_heap_pages() will ignore - * TLB-flushes. After VM creation, this is a security issue (it can - * make pages accessible to guest B, when guest A may still have a - * cached mapping to them). So we do this only during domain creation, - * when the domain itself has not yet been unpaused for the first - * time. - */ - a->memflags |= MEMF_no_tlbflush; /* * With MEMF_no_icache_flush, alloc_heap_pages() will skip * performing icache flushes. We do it only before domain @@ -396,13 +385,6 @@ static void populate_physmap(struct memop_args *a) } } - if ( unlikely(a->memflags & MEMF_no_tlbflush) ) - { - for ( j = 0; j < (1U << a->extent_order); j++ ) - accumulate_tlbflush(&need_tlbflush, &page[j], - &tlbflush_timestamp); - } - mfn = page_to_mfn(page); } @@ -417,9 +399,6 @@ static void populate_physmap(struct memop_args *a) } out: - if ( need_tlbflush ) - filtered_flush_tlb_mask(tlbflush_timestamp); - if ( a->memflags & MEMF_no_icache_flush ) invalidate_icache(); diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 40b0f73563..3f9f46dd58 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1099,15 +1099,17 @@ static struct page_info *alloc_heap_pages( /* Preserve PGC_need_scrub so we can check it after lock is dropped. */ pg[i].count_info = PGC_state_inuse | (pg[i].count_info & PGC_need_scrub); - if ( !(memflags & MEMF_no_tlbflush) ) - accumulate_tlbflush(&need_tlbflush, &pg[i], - &tlbflush_timestamp); + accumulate_tlbflush(&need_tlbflush, &pg[i], &tlbflush_timestamp); init_free_page_fields(&pg[i]); } spin_unlock(&heap_lock); + /* Flush ahead of scrubbing: ensure no PV domain has a stale TLB entry. */ + if ( need_tlbflush ) + filtered_flush_tlb_mask(tlbflush_timestamp); + if ( first_dirty != INVALID_DIRTY_IDX || (scrub_debug && !(memflags & MEMF_no_scrub)) ) { @@ -1143,9 +1145,6 @@ static struct page_info *alloc_heap_pages( } } - if ( need_tlbflush ) - filtered_flush_tlb_mask(tlbflush_timestamp); - /* * Ensure cache and RAM are consistent for platforms where the guest * can control its own visibility of/through the cache. @@ -1399,6 +1398,13 @@ bool scrub_free_pages(void) { if ( test_bit(_PGC_need_scrub, &pg[i].count_info) ) { + bool need_tlbflush = false; + uint32_t tlbflush_ts = 0; + + accumulate_tlbflush(&need_tlbflush, &pg[i], &tlbflush_ts); + if ( need_tlbflush ) + filtered_flush_tlb_mask(tlbflush_ts); + scrub_one_page(&pg[i], true); /* * We can modify count_info without holding heap @@ -2066,7 +2072,7 @@ static struct page_info *alloc_color_heap_page(unsigned int memflags, uint32_t tlbflush_timestamp = 0; bool need_scrub; - if ( memflags & ~(MEMF_no_refcount | MEMF_no_owner | MEMF_no_tlbflush | + if ( memflags & ~(MEMF_no_refcount | MEMF_no_owner | MEMF_no_icache_flush | MEMF_no_scrub) ) return NULL; @@ -2095,13 +2101,16 @@ static struct page_info *alloc_color_heap_page(unsigned int memflags, free_colored_pages[color]--; page_list_del(pg, color_heap(color)); - if ( !(memflags & MEMF_no_tlbflush) ) - accumulate_tlbflush(&need_tlbflush, pg, &tlbflush_timestamp); + accumulate_tlbflush(&need_tlbflush, pg, &tlbflush_timestamp); init_free_page_fields(pg); spin_unlock(&heap_lock); + /* Flush ahead of scrubbing: ensure no PV domain has a stale TLB entry. */ + if ( need_tlbflush ) + filtered_flush_tlb_mask(tlbflush_timestamp); + if ( !(memflags & MEMF_no_scrub) ) { if ( need_scrub ) @@ -2110,9 +2119,6 @@ static struct page_info *alloc_color_heap_page(unsigned int memflags, check_one_page(pg); } - if ( need_tlbflush ) - filtered_flush_tlb_mask(tlbflush_timestamp); - flush_page_to_ram(mfn_x(page_to_mfn(pg)), !(memflags & MEMF_no_icache_flush)); @@ -3027,9 +3033,7 @@ static bool prepare_staticmem_pages(struct page_info *pg, unsigned long nr_mfns, goto out_err; } - if ( !(memflags & MEMF_no_tlbflush) ) - accumulate_tlbflush(&need_tlbflush, &pg[i], - &tlbflush_timestamp); + accumulate_tlbflush(&need_tlbflush, &pg[i], &tlbflush_timestamp); /* * Preserve flag PGC_static and change page state diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h index b80bec00c1..379a8e4cbe 100644 --- a/xen/include/xen/mm.h +++ b/xen/include/xen/mm.h @@ -222,8 +222,6 @@ struct npfec { #define MEMF_exact_node (1U<<_MEMF_exact_node) #define _MEMF_no_owner 5 #define MEMF_no_owner (1U<<_MEMF_no_owner) -#define _MEMF_no_tlbflush 6 -#define MEMF_no_tlbflush (1U<<_MEMF_no_tlbflush) #define _MEMF_no_icache_flush 7 #define MEMF_no_icache_flush (1U<<_MEMF_no_icache_flush) #define _MEMF_no_scrub 8 ++++++ 6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch ++++++ Subject: x86/emul: cope with internal handlers returning X86EMUL_RETRY From: Roger Pau Monne [email protected] Fri Aug 7 11:03:48 2026 +0200 Date: Wed Aug 26 17:48:17 2026 +0100: Git: 41f73fe55bad6269bc03e25bf878ab608017acee hvm_io_intercept() can return X86EMUL_RETRY, and as such it needs to be handled in the switch in hvmemul_do_io() to avoid triggering the BUG() from the default case. Reset the vCPU state to no in-flight IOREQ and return X86EMUL_RETRY so that the access is retried. This is XSA-510 / CVE-2026-79602. Reported-by: Jiqian Chen <[email protected]> Signed-off-by: Roger Pau Monné <[email protected]> Reviewed-by: Jan Beulich <[email protected]> (cherry picked from commit 62aff073266bd83fa2d675913d913134abd3c82b) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 2efb1d4f08..c09ea002ec 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -308,6 +308,7 @@ static int hvmemul_do_io( switch ( rc ) { case X86EMUL_OKAY: + case X86EMUL_RETRY: vio->req.state = STATE_IOREQ_NONE; break; case X86EMUL_UNHANDLEABLE: ++++++ 6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch ++++++ Subject: x86/pass-through: disallow pt_irq_create_bind() on dying domains From: Jan Beulich [email protected] Wed Aug 26 17:47:41 2026 +0100 Date: Wed Aug 26 17:48:17 2026 +0100: Git: cad43d95a2a3c95b3d75f56b8db3e08410757305 DMs may invoke XEN_DOMCTL_bind_pt_irq for domains already under destruction. When XEN_DOMCTL_bind_pt_irq is invoked after pci_release_devices() (invoked from underneath domain_kill()) had already completed, it would allocate hvm_domain_irq(d)->dpci anew, without that ever being freed during subsequent domain cleanup. Leverage evtchn_destroy()'s kind-of-spin-barrier, allowing to simply check ->is_dying with the domain's event lock held. This is XSA-509 / CVE-2026-62437. Fixes: 7a26b541a202 ("vtd: Dynamically allocate IRQ-tracking structures, only for those") Signed-off-by: Jan Beulich <[email protected]> Reviewed-by: Roger Pau Monné <[email protected]> (cherry picked from commit 328a1461430f82d5f0318511e71b7143cdbca872) diff --git a/xen/drivers/passthrough/x86/hvm.c b/xen/drivers/passthrough/x86/hvm.c index b73bb55055..32632a3b15 100644 --- a/xen/drivers/passthrough/x86/hvm.c +++ b/xen/drivers/passthrough/x86/hvm.c @@ -231,6 +231,12 @@ int pt_irq_create_bind( restart: write_lock(&d->event_lock); + if ( d->is_dying ) + { + write_unlock(&d->event_lock); + return -ESRCH; + } + hvm_irq_dpci = domain_get_irq_dpci(d); if ( !hvm_irq_dpci && !is_hardware_domain(d) ) {
