Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1574836
| From | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 3.10 037/319] xen/pciback: Save xen_pci_op commands before processing it |
| Date | 2017-02-06 15:40 +0100 |
| Message-ID | <t7SCu-68H-11@gated-at.bofh.it> (permalink) |
| References | <t7AFA-32I-9@gated-at.bofh.it> <t7BrZ-3BL-45@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Sun, Feb 05, 2017 at 08:20:24PM +0100, Willy Tarreau wrote:
> From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>
> commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 upstream.
You also need:
commit d159457b84395927b5a52adb72f748dd089ad5e5
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date: Thu Feb 11 16:10:24 2016 -0500
xen/pciback: Save the number of MSI-X entries to be copied later.
Commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 (xen/pciback: Save
xen_pci_op commands before processing it) broke enabling MSI-X because
it would never copy the resulting vectors into the response. The
number of vectors requested was being overwritten by the return value
(typically zero for success).
>
> Double fetch vulnerabilities that happen when a variable is
> fetched twice from shared memory but a security check is only
> performed the first time.
>
> The xen_pcibk_do_op function performs a switch statements on the op->cmd
> value which is stored in shared memory. Interestingly this can result
> in a double fetch vulnerability depending on the performed compiler
> optimization.
>
> This patch fixes it by saving the xen_pci_op command before
> processing it. We also use 'barrier' to make sure that the
> compiler does not perform any optimization.
>
> This is part of XSA155.
>
> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Signed-off-by: Jan Beulich <JBeulich@suse.com>
> Signed-off-by: David Vrabel <david.vrabel@citrix.com>
> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Cc: "Jan Beulich" <JBeulich@suse.com>
> Signed-off-by: Willy Tarreau <w@1wt.eu>
> ---
> drivers/xen/xen-pciback/pciback.h | 1 +
> drivers/xen/xen-pciback/pciback_ops.c | 15 ++++++++++++++-
> 2 files changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
> index f72af87..560b3ec 100644
> --- a/drivers/xen/xen-pciback/pciback.h
> +++ b/drivers/xen/xen-pciback/pciback.h
> @@ -37,6 +37,7 @@ struct xen_pcibk_device {
> struct xen_pci_sharedinfo *sh_info;
> unsigned long flags;
> struct work_struct op_work;
> + struct xen_pci_op op;
> };
>
> struct xen_pcibk_dev_data {
> diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
> index b98cf0c..32f83f0 100644
> --- a/drivers/xen/xen-pciback/pciback_ops.c
> +++ b/drivers/xen/xen-pciback/pciback_ops.c
> @@ -295,9 +295,11 @@ void xen_pcibk_do_op(struct work_struct *data)
> container_of(data, struct xen_pcibk_device, op_work);
> struct pci_dev *dev;
> struct xen_pcibk_dev_data *dev_data = NULL;
> - struct xen_pci_op *op = &pdev->sh_info->op;
> + struct xen_pci_op *op = &pdev->op;
> int test_intx = 0;
>
> + *op = pdev->sh_info->op;
> + barrier();
> dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
>
> if (dev == NULL)
> @@ -339,6 +341,17 @@ void xen_pcibk_do_op(struct work_struct *data)
> if ((dev_data->enable_intx != test_intx))
> xen_pcibk_control_isr(dev, 0 /* no reset */);
> }
> + pdev->sh_info->op.err = op->err;
> + pdev->sh_info->op.value = op->value;
> +#ifdef CONFIG_PCI_MSI
> + if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
> + unsigned int i;
> +
> + for (i = 0; i < op->value; i++)
> + pdev->sh_info->op.msix_entries[i].vector =
> + op->msix_entries[i].vector;
> + }
> +#endif
> /* Tell the driver domain that we're done. */
> wmb();
> clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
> --
> 2.8.0.rc2.1.gbe9624a
>
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.10 030/319] PM / devfreq: Fix incorrect type issue. Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 067/319] powerpc/64: Fix incorrect return value from __copy_tofrom_user Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 040/319] xen/pciback: Do not install an IRQ handler for MSI interrupts. Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 079/319] score: fix __get_user/get_user Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 095/319] openrisc: fix the fix of copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 086/319] score: fix copy_from_user() and friends Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 072/319] s390/dasd: fix hanging device after clear subchannel Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
[PATCH 3.10 060/319] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
[PATCH 3.10 093/319] parisc: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
[PATCH 3.10 087/319] sh: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
[PATCH 3.10 094/319] openrisc: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
[PATCH 3.10 063/319] MIPS: ptrace: Fix regs_return_value for kernel context Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
[PATCH 3.10 059/319] arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
[PATCH 3.10 055/319] ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
[PATCH 3.10 034/319] xen-netback: don't use last request to determine minimum Tx credit Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
[PATCH 3.10 091/319] alpha: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
[PATCH 3.10 076/319] mn10300: failing __get_user() and get_user() should zero Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
[PATCH 3.10 070/319] avr32: fix 'undefined reference to `___copy_from_user' Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
[PATCH 3.10 049/319] x86/paravirt: Do not trace _paravirt_ident_*() functions Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
[PATCH 3.10 068/319] powerpc/nvram: Fix an incorrect partition merge Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
[PATCH 3.10 075/319] microblaze: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
[PATCH 3.10 041/319] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 085/319] blackfin: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 046/319] x86/mm: Disable preemption during CR3 read+write Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 048/319] x86/mm/pat, /dev/mem: Remove superfluous error message Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 081/319] ARC: uaccess: get_user to zero out dest in cause of fault Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 037/319] xen/pciback: Save xen_pci_op commands before processing it Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
Re: [PATCH 3.10 037/319] xen/pciback: Save xen_pci_op commands before processing it Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> - 2017-02-06 15:40 +0100
Re: [PATCH 3.10 037/319] xen/pciback: Save xen_pci_op commands before processing it Willy Tarreau <w@1wt.eu> - 2017-02-06 23:40 +0100
[PATCH 3.10 050/319] x86/build: Build compressed x86 kernels as PIE Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 057/319] ARM: sa1111: fix pcmcia suspend/resume Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 032/319] x86/mm/xen: Suppress hugetlbfs in PV guests Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
[PATCH 3.10 098/319] ppc32: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 053/319] iommu/amd: Free domain id when free a domain of struct dma_ops_domain Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 099/319] ia64: copy_from_user() should zero the destination on access_ok() failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 092/319] metag: copy_from_user() should zero the destination on access_ok() failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 047/319] x86/apic: Do not init irq remapping if ioapic is disabled Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 066/319] powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 058/319] arm64: avoid returning from bad_mode Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 065/319] powerpc/vdso64: Use double word compare on pointers Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 031/319] ppp: defer netns reference release for ppp channel Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 064/319] powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 035/319] xen-netback: use RING_COPY_REQUEST() throughout Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 062/319] MIPS: Malta: Fix IOCU disable switch read for MIPS64 Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 033/319] xen: Add RING_COPY_REQUEST() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 078/319] sh64: failing __get_user() should zero Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 089/319] mips: copy_from_user() must zero the destination on access_ok() failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 036/319] xen-blkback: only read request operation from shared ring once Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 083/319] frv: fix clear_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 080/319] s390: get_user() should zero on failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 073/319] parisc: Ensure consistent state when switching to kernel stack at syscall entry Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 038/319] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 054/319] ARM: 8616/1: dt: Respect property size when parsing CPUs Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 088/319] hexagon: fix strncpy_from_user() error return Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 052/319] iommu/amd: Update Alias-DTE in update_device_table() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 039/319] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 090/319] asm-generic: make copy_from_user() zero the destination properly Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 044/319] x86/xen: fix upper bound of pmd loop in xen_cleanhighmap() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
[PATCH 3.10 045/319] x86/traps: Ignore high word of regs->cs in early_idt_handler_common Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
[PATCH 3.10 042/319] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
[PATCH 3.10 061/319] arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
[PATCH 3.10 097/319] sparc32: fix copy_from_user() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
[PATCH 3.10 051/319] x86/um: reuse asm-generic/barrier.h Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
[PATCH 3.10 043/319] xen-pciback: Add name prefix to global 'permissive' variable Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
csiph-web