The branch main has been updated by royger: URL: https://cgit.FreeBSD.org/src/commit/?id=e99c0c8b79b030e6c63e4f7149154d926a360664
commit e99c0c8b79b030e6c63e4f7149154d926a360664 Author: Dan Carpenter <[email protected]> AuthorDate: 2019-04-04 15:12:17 +0000 Commit: Roger Pau Monné <[email protected]> CommitDate: 2022-05-06 07:31:32 +0000 xen: Prevent buffer overflow in privcmd ioctl The "call" variable comes from the user in privcmd_ioctl_hypercall(). It's an offset into the hypercall_page[] which has (PAGE_SIZE / 32) elements. We need to put an upper bound on it to prevent an out of bounds access. Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Juergen Gross <[email protected]> Obtained from: Linux Linux commit: 42d8644bd77dd2d747e004e367cb0c895a606f39 Fixes: bf7313e3b79 ("xen: implement the privcmd user-space device") Submitted by: Elliott Mitchell <[email protected]> Reviewed by: royger --- sys/amd64/include/xen/hypercall.h | 3 +++ sys/i386/include/xen/hypercall.h | 3 +++ 2 files changed, 6 insertions(+) diff --git a/sys/amd64/include/xen/hypercall.h b/sys/amd64/include/xen/hypercall.h index 6d00d4a6ebd8..60da390ef4c6 100644 --- a/sys/amd64/include/xen/hypercall.h +++ b/sys/amd64/include/xen/hypercall.h @@ -145,6 +145,9 @@ privcmd_hypercall(long op, long a1, long a2, long a3, long a4, long a5) register long __arg5 __asm__("r8") = (long)(a5); long __call = (long)&hypercall_page + (op * 32); + if (op >= PAGE_SIZE / 32) + return -EINVAL; + __asm__ volatile ( "call *%[call]" : "=a" (__res), "=D" (__ign1), "=S" (__ign2), diff --git a/sys/i386/include/xen/hypercall.h b/sys/i386/include/xen/hypercall.h index 4002aac58d84..f1757e8becaf 100644 --- a/sys/i386/include/xen/hypercall.h +++ b/sys/i386/include/xen/hypercall.h @@ -122,6 +122,9 @@ privcmd_hypercall(long op, long a1, long a2, long a3, long a4, long a5) { long __res, __ign1, __ign2, __ign3, __ign4, __ign5, __call; + if (op >= PAGE_SIZE / 32) + return -EINVAL; + __call = (long)&hypercall_page + (op * 32); __asm__ volatile ( "call *%[call]"
