On 23.12.2019 19:08, George Dunlap wrote:
> On 12/23/19 2:04 PM, Alexandru Stefan ISAILA wrote:
>> This patch aims to sanitize indexes, potentially guest provided
>> values, for altp2m_eptp[] and altp2m_p2m[] arrays.
>>
>> Requested-by: Jan Beulich <jbeul...@suse.com>
>> Signed-off-by: Alexandru Isaila <aisa...@bitdefender.com>
>> ---
>> CC: Razvan Cojocaru <rcojoc...@bitdefender.com>
>> CC: Tamas K Lengyel <ta...@tklengyel.com>
>> CC: Petre Pircalabu <ppircal...@bitdefender.com>
>> CC: George Dunlap <george.dun...@eu.citrix.com>
>> CC: Jan Beulich <jbeul...@suse.com>
>> CC: Andrew Cooper <andrew.coop...@citrix.com>
>> CC: Wei Liu <w...@xen.org>
>> CC: "Roger Pau Monné" <roger....@citrix.com>
>> CC: Jun Nakajima <jun.nakaj...@intel.com>
>> CC: Kevin Tian <kevin.t...@intel.com>
>> ---
>> Changes since V5:
>> - Add black lines
>> - Check altp2m_idx against min(ARRAY_SIZE(d->arch.altp2m_p2m),
>> MAX_EPTP).
>> ---
>> xen/arch/x86/mm/mem_access.c | 21 ++++++++++++---------
>> xen/arch/x86/mm/p2m.c | 26 ++++++++++++++++++--------
>> 2 files changed, 30 insertions(+), 17 deletions(-)
>>
>> diff --git a/xen/arch/x86/mm/mem_access.c b/xen/arch/x86/mm/mem_access.c
>> index 320b9fe621..a95a50bcae 100644
>> --- a/xen/arch/x86/mm/mem_access.c
>> +++ b/xen/arch/x86/mm/mem_access.c
>> @@ -366,11 +366,12 @@ long p2m_set_mem_access(struct domain *d, gfn_t gfn,
>> uint32_t nr,
>> #ifdef CONFIG_HVM
>> if ( altp2m_idx )
>> {
>> - if ( altp2m_idx >= MAX_ALTP2M ||
>> - d->arch.altp2m_eptp[altp2m_idx] == mfn_x(INVALID_MFN) )
>> + if ( altp2m_idx >= min(ARRAY_SIZE(d->arch.altp2m_p2m), MAX_EPTP) ||
>> + d->arch.altp2m_eptp[array_index_nospec(altp2m_idx, MAX_EPTP)]
>> ==
>> + mfn_x(INVALID_MFN) )
>> return -EINVAL;
>
> I realize Jan asked for something like this, and I'm sorry I didn't have
> time to bring it up then, but this seems really silly. If we're worried
> about this, wouldn't it be better to have a BUILD_BUG_ON(MAX_ALTP2M >
> MAX_EPTP)?
I wouldn't mind this BUILD_BUG_ON() approach as an alternative,
but imo one such instance would then need attaching to every
site.
> Also, this bit where we check the array value and then re-mask the index
> later seems really redundant;
But that's the idea behind the *_nospec() additions: They are to
guard against speculation, i.e. both the bounds check and the
masking of the index have their (distinct) reason.
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
