XENMAPSPACE_gmfn{_range} allows moving gfn around the guest p2m: the mfn
behind the source gfn is zapped from the origin and mapped at the
requested destination gfn. The destination p2m entries are always created
with type p2m_ram_rw.
With the current checking done in xenmem_add_to_physmap_one() it's possible
to use XENMAPSPACE_gmfn{_range} to change the type of a p2m entry. The
source gfn is only checked to be not shared, and that the underlying page
is owned by the domain.
Make the source checks more strict, by checking that the source gfn is of
type p2m_ram_rw. That prevents the operation from inadvertently changing
the type as part of the move.
Signed-off-by: Roger Pau Monné <[email protected]>
---
The change was discussed internally by the security team and deemed not a
security issue.
---
xen/arch/x86/mm/p2m.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
index e2a00a0efd0c..452b2f8f0f10 100644
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -2007,11 +2007,15 @@ int xenmem_add_to_physmap_one(
{
gmfn = idx;
mfn = get_gfn_unshare(d, gmfn, &p2mt);
- /* If the page is still shared, exit early */
- if ( p2m_is_shared(p2mt) )
+ /*
+ * The entry at the destination gfn will be created as type p2m_ram_rw.
+ * Only allow moving source gfns with p2m_ram_rw type to avoid
+ * unexpected p2m type changes as a result of the operation.
+ */
+ if ( p2mt != p2m_ram_rw )
{
put_gfn(d, gmfn);
- return -ENOMEM;
+ return -EACCES;
}
page = get_page_from_mfn(mfn, d);
if ( unlikely(!page) )
--
2.51.0
