Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8e8fb99a39c6c1dc82740eabf8778cccfe0f6b49)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8e8fb99a39c6c1dc82740eabf8778cccfe0f6b49)
  • Date: Sat, 22 Dec 2012 10:44:41 -0600

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

utils/xen/DETAILS | 3
utils/xen/HISTORY | 5
utils/xen/PRE_BUILD | 19 --
utils/xen/xsa-12.patch | 22 --
utils/xen/xsa-13.patch | 30 ---
utils/xen/xsa-14.patch | 22 --
utils/xen/xsa-16.patch | 31 ---
utils/xen/xsa-17.patch | 113 ------------
utils/xen/xsa-19.patch | 11 -
utils/xen/xsa-20.patch | 38 ----
utils/xen/xsa-21.patch | 31 ---
utils/xen/xsa-22.patch | 40 ----
utils/xen/xsa-23.patch | 32 ---
utils/xen/xsa-24.patch | 26 --
utils/xen/xsa-25.patch | 461
-------------------------------------------------
utils/xen/xsa-26.patch | 107 -----------
utils/xen/xsa-27.patch | 168 -----------------
utils/xen/xsa-28.patch | 36 ---
utils/xen/xsa-29.patch | 49 -----
utils/xen/xsa-30.patch | 57 ------
utils/xen/xsa-31.patch | 50 -----
21 files changed, 6 insertions(+), 1345 deletions(-)

New commits:
commit c13f90b28aa40be4ab4ad4c17ea42904340b799c
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

xen: => 4.1.4

diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index f48118c..dd80218 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,7 +1,6 @@
SPELL=xen
- VERSION=4.1.3
+ VERSION=4.1.4
SECURITY_PATCH=5
- PATCHLEVEL=1
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index 65146a9..118a9bf 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,3 +1,8 @@
+2012-12-22 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 4.1.4
+ * PRE_BUILD: removed patches
+ * xsa-*.patch: removed, fixed by upstream
+
2012-12-11 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: PATCHLEVEL=1
* init.d/xendomains: corrected detection of running domUs after
instant
diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index c738dc4..c7f9a4a 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -1,25 +1,6 @@
default_pre_build &&
cd ${SOURCE_DIRECTORY} &&

-patch -p1 < "$SPELL_DIRECTORY/xsa-12.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-13.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-14.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-16.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-17.patch" &&
-patch -p0 < "$SPELL_DIRECTORY/xsa-19.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-20.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-21.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-22.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-23.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-24.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-25.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-26.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-27.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-28.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-29.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-30.patch" &&
-patch -p1 < "$SPELL_DIRECTORY/xsa-31.patch" &&
-
if [[ $XEN_UPINIT != y ]]; then
sedit "s:all install-initd:all:" tools/hotplug/Linux/Makefile
fi &&
diff --git a/utils/xen/xsa-12.patch b/utils/xen/xsa-12.patch
deleted file mode 100644
index 271c4d8..0000000
--- a/utils/xen/xsa-12.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-xen: prevent a 64 bit guest setting reserved bits in DR7
-
-The upper 32 bits of this register are reserved and should be written as
-zero.
-
-This is XSA-12 / CVE-2012-3494
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff -r 353bc0801b11 xen/include/asm-x86/debugreg.h
---- a/xen/include/asm-x86/debugreg.h Mon Aug 06 12:28:03 2012 +0100
-+++ b/xen/include/asm-x86/debugreg.h Wed Aug 15 12:00:21 2012 +0100
-@@ -58,7 +58,7 @@
- We can slow the instruction pipeline for instructions coming via the
- gdt or the ldt if we want to. I am not sure why this is an advantage */
-
--#define DR_CONTROL_RESERVED_ZERO (0x0000d800ul) /* Reserved, read as zero */
-+#define DR_CONTROL_RESERVED_ZERO (~0xffff27fful) /* Reserved, read as zero
*/
- #define DR_CONTROL_RESERVED_ONE (0x00000400ul) /* Reserved, read as one */
- #define DR_LOCAL_EXACT_ENABLE (0x00000100ul) /* Local exact enable */
- #define DR_GLOBAL_EXACT_ENABLE (0x00000200ul) /* Global exact enable */
diff --git a/utils/xen/xsa-13.patch b/utils/xen/xsa-13.patch
deleted file mode 100644
index 35c4715..0000000
--- a/utils/xen/xsa-13.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-xen: handle out-of-pirq condition correctly in PHYSDEVOP_get_free_pirq
-
-This is XSA-13 / CVE-2012-3495
-
-Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
-Signed-off-by: Jan Beulich <JBeulich AT suse.com>
-
-diff -r 1225aff05dd2 xen/arch/x86/physdev.c
---- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
-+++ b/xen/arch/x86/physdev.c Thu Aug 16 11:07:36 2012 +0100
-@@ -587,11 +587,16 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
- break;
-
- spin_lock(&d->event_lock);
-- out.pirq = get_free_pirq(d, out.type, 0);
-- d->arch.pirq_irq[out.pirq] = PIRQ_ALLOCATED;
-+ ret = get_free_pirq(d, out.type, 0);
-+ if ( ret >= 0 )
-+ d->arch.pirq_irq[ret] = PIRQ_ALLOCATED;
- spin_unlock(&d->event_lock);
-
-- ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
-+ if ( ret >= 0 )
-+ {
-+ out.pirq = ret;
-+ ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
-+ }
-
- rcu_unlock_domain(d);
- break;
diff --git a/utils/xen/xsa-14.patch b/utils/xen/xsa-14.patch
deleted file mode 100644
index cd185b3..0000000
--- a/utils/xen/xsa-14.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-xen: Don't BUG_ON() PoD operations on a non-translated guest.
-
-This is XSA-14 / CVE-2012-3496
-
-Signed-off-by: Tim Deegan <tim AT xen.org>
-Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
-Tested-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff -r 6779ddca8593 -r 8ebda5388e4e xen/arch/x86/mm/p2m.c
---- a/xen/arch/x86/mm/p2m.c Wed Sep 05 12:28:17 2012 +0100
-+++ b/xen/arch/x86/mm/p2m.c Wed Sep 05 12:29:05 2012 +0100
-@@ -2414,7 +2414,8 @@ guest_physmap_mark_populate_on_demand(st
- int pod_count = 0;
- int rc = 0;
-
-- BUG_ON(!paging_mode_translate(d));
-+ if ( !paging_mode_translate(d) )
-+ return -EINVAL;
-
- rc = gfn_check_limit(d, gfn, order);
- if ( rc != 0 )
-
diff --git a/utils/xen/xsa-16.patch b/utils/xen/xsa-16.patch
deleted file mode 100644
index d9662d8..0000000
--- a/utils/xen/xsa-16.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI
-
-This is being used as a array index, and hence must be validated before
-use.
-
-This is XSA-16 / CVE-2012-3498.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-
-diff -r 1225aff05dd2 xen/arch/x86/physdev.c
---- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
-+++ b/xen/arch/x86/physdev.c Thu Aug 16 13:03:36 2012 +0100
-@@ -40,11 +40,18 @@ static int physdev_hvm_map_pirq(
- struct hvm_girq_dpci_mapping *girq;
- uint32_t machine_gsi = 0;
-
-+ if ( map->index < 0 || map->index >= NR_HVM_IRQS )
-+ {
-+ ret = -EINVAL;
-+ break;
-+ }
-+
- /* find the machine gsi corresponding to the
- * emulated gsi */
- hvm_irq_dpci = domain_get_irq_dpci(d);
- if ( hvm_irq_dpci )
- {
-+ BUILD_BUG_ON(ARRAY_SIZE(hvm_irq_dpci->girq) < NR_HVM_IRQS);
- list_for_each_entry ( girq,
- &hvm_irq_dpci->girq[map->index],
- list )
diff --git a/utils/xen/xsa-17.patch b/utils/xen/xsa-17.patch
deleted file mode 100644
index 9aa28e0..0000000
--- a/utils/xen/xsa-17.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-console: bounds check whenever changing the cursor due to an escape code
-
-This is XSA-17 / CVE-2012-3515
-
-Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff --git a/console.c b/console.c
-index 5e6e3d0..9984d6f 100644
---- a/tools/ioemu-qemu-xen/console.c
-+++ b/tools/ioemu-qemu-xen/console.c
-@@ -794,6 +794,26 @@ static void console_clear_xy(TextConsole *s, int x, int
y)
- update_xy(s, x, y);
- }
-
-+/* set cursor, checking bounds */
-+static void set_cursor(TextConsole *s, int x, int y)
-+{
-+ if (x < 0) {
-+ x = 0;
-+ }
-+ if (y < 0) {
-+ y = 0;
-+ }
-+ if (y >= s->height) {
-+ y = s->height - 1;
-+ }
-+ if (x >= s->width) {
-+ x = s->width - 1;
-+ }
-+
-+ s->x = x;
-+ s->y = y;
-+}
-+
- static void console_putchar(TextConsole *s, int ch)
- {
- TextCell *c;
-@@ -869,7 +889,8 @@ static void console_putchar(TextConsole *s, int ch)
- s->esc_params[s->nb_esc_params] * 10 + ch - '0';
- }
- } else {
-- s->nb_esc_params++;
-+ if (s->nb_esc_params < MAX_ESC_PARAMS)
-+ s->nb_esc_params++;
- if (ch == ';')
- break;
- #ifdef DEBUG_CONSOLE
-@@ -883,59 +904,37 @@ static void console_putchar(TextConsole *s, int ch)
- if (s->esc_params[0] == 0) {
- s->esc_params[0] = 1;
- }
-- s->y -= s->esc_params[0];
-- if (s->y < 0) {
-- s->y = 0;
-- }
-+ set_cursor(s, s->x, s->y - s->esc_params[0]);
- break;
- case 'B':
- /* move cursor down */
- if (s->esc_params[0] == 0) {
- s->esc_params[0] = 1;
- }
-- s->y += s->esc_params[0];
-- if (s->y >= s->height) {
-- s->y = s->height - 1;
-- }
-+ set_cursor(s, s->x, s->y + s->esc_params[0]);
- break;
- case 'C':
- /* move cursor right */
- if (s->esc_params[0] == 0) {
- s->esc_params[0] = 1;
- }
-- s->x += s->esc_params[0];
-- if (s->x >= s->width) {
-- s->x = s->width - 1;
-- }
-+ set_cursor(s, s->x + s->esc_params[0], s->y);
- break;
- case 'D':
- /* move cursor left */
- if (s->esc_params[0] == 0) {
- s->esc_params[0] = 1;
- }
-- s->x -= s->esc_params[0];
-- if (s->x < 0) {
-- s->x = 0;
-- }
-+ set_cursor(s, s->x - s->esc_params[0], s->y);
- break;
- case 'G':
- /* move cursor to column */
-- s->x = s->esc_params[0] - 1;
-- if (s->x < 0) {
-- s->x = 0;
-- }
-+ set_cursor(s, s->esc_params[0] - 1, s->y);
- break;
- case 'f':
- case 'H':
- /* move cursor to row, column */
-- s->x = s->esc_params[1] - 1;
-- if (s->x < 0) {
-- s->x = 0;
-- }
-- s->y = s->esc_params[0] - 1;
-- if (s->y < 0) {
-- s->y = 0;
-- }
-+ set_cursor(s, s->esc_params[1] - 1, s->esc_params[0] - 1);
- break;
- case 'J':
- switch (s->esc_params[0]) {
diff --git a/utils/xen/xsa-19.patch b/utils/xen/xsa-19.patch
deleted file mode 100644
index 65b25ca..0000000
--- a/utils/xen/xsa-19.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- tools/ioemu-qemu-xen/vl.c.orig 2012-04-24 21:35:40.000000000 +0400
-+++ tools/ioemu-qemu-xen/vl.c 2012-09-19 14:44:19.190522811 +0400
-@@ -4910,7 +4910,7 @@
- kernel_cmdline = "";
- cyls = heads = secs = 0;
- translation = BIOS_ATA_TRANSLATION_AUTO;
-- monitor_device = "vc:80Cx24C";
-+ monitor_device = "null";
-
- serial_devices[0] = "vc:80Cx24C";
- for(i = 1; i < MAX_SERIAL_PORTS; i++)
diff --git a/utils/xen/xsa-20.patch b/utils/xen/xsa-20.patch
deleted file mode 100644
index bedd318..0000000
--- a/utils/xen/xsa-20.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerability
-
-The timer action for a vcpu periodic timer is to calculate the next
-expiry time, and to reinsert itself into the timer queue. If the
-deadline ends up in the past, Xen never leaves __do_softirq(). The
-affected PCPU will stay in an infinite loop until Xen is killed by the
-watchdog (if enabled).
-
-This is a security problem, XSA-20 / CVE-2012-4535.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff -r 478ba3f146df xen/common/domain.c
---- a/xen/common/domain.c
-+++ b/xen/common/domain.c
-@@ -903,6 +903,9 @@ long do_vcpu_op(int cmd, int vcpuid, XEN
- if ( set.period_ns < MILLISECS(1) )
- return -EINVAL;
-
-+ if ( set.period_ns > STIME_DELTA_MAX )
-+ return -EINVAL;
-+
- v->periodic_period = set.period_ns;
- vcpu_force_reschedule(v);
-
-diff -r 478ba3f146df xen/include/xen/time.h
---- a/xen/include/xen/time.h
-+++ b/xen/include/xen/time.h
-@@ -55,6 +55,8 @@ struct tm gmtime(unsigned long t);
- #define MILLISECS(_ms) ((s_time_t)((_ms) * 1000000ULL))
- #define MICROSECS(_us) ((s_time_t)((_us) * 1000ULL))
- #define STIME_MAX ((s_time_t)((uint64_t)~0ull>>1))
-+/* Chosen so (NOW() + delta) wont overflow without an uptime of 200 years */
-+#define STIME_DELTA_MAX ((s_time_t)((uint64_t)~0ull>>2))
-
- extern void update_vcpu_system_time(struct vcpu *v);
- extern void update_domain_wallclock_time(struct domain *d);
diff --git a/utils/xen/xsa-21.patch b/utils/xen/xsa-21.patch
deleted file mode 100644
index 14158ef..0000000
--- a/utils/xen/xsa-21.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-x86/physdev: Range check pirq parameter from guests
-
-Otherwise Xen will read beyond either end of the struct
-domain.arch.pirq_emuirq array, usually resulting in a fatal page fault.
-
-This vulnerability was introduced by c/s 23241:d21100f1d00e, which adds
-a call to domain_pirq_to_emuirq() which uses the guest provided pirq
-value before range checking it, and was fixed by c/s 23573:584c2e5e03d9
-which changed the behaviour of the domain_pirq_to_emuirq() macro to use
-radix trees instead of a flat array.
-
-This is XSA-21 / CVE-2012-4536.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
-Acked-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff -r 7a401a73d86d xen/arch/x86/physdev.c
---- a/xen/arch/x86/physdev.c
-+++ b/xen/arch/x86/physdev.c
-@@ -234,6 +234,10 @@ static int physdev_unmap_pirq(struct phy
- if ( ret )
- return ret;
-
-+ ret = -EINVAL;
-+ if ( unmap->pirq < 0 || unmap->pirq >= d->nr_pirqs )
-+ goto free_domain;
-+
- if ( is_hvm_domain(d) )
- {
- spin_lock(&d->event_lock);
diff --git a/utils/xen/xsa-22.patch b/utils/xen/xsa-22.patch
deleted file mode 100644
index bb2b88e..0000000
--- a/utils/xen/xsa-22.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-x86/physmap: Prevent incorrect updates of m2p mappings
-
-In certain conditions, such as low memory, set_p2m_entry() can fail.
-Currently, the p2m and m2p tables will get out of sync because we still
-update the m2p table after the p2m update has failed.
-
-If that happens, subsequent guest-invoked memory operations can cause
-BUG()s and ASSERT()s to kill Xen.
-
-This is fixed by only updating the m2p table iff the p2m was
-successfully updated.
-
-This is a security problem, XSA-22 / CVE-2012-4537.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-diff -r 3a27f4e44b6a xen/arch/x86/mm/p2m.c
---- a/xen/arch/x86/mm/p2m.c
-+++ b/xen/arch/x86/mm/p2m.c
-@@ -2558,7 +2558,10 @@ guest_physmap_add_entry(struct p2m_domai
- if ( mfn_valid(_mfn(mfn)) )
- {
- if ( !set_p2m_entry(p2m, gfn, _mfn(mfn), page_order, t,
p2m->default_access) )
-+ {
- rc = -EINVAL;
-+ goto out; /* Failed to update p2m, bail without updating m2p. */
-+ }
- if ( !p2m_is_grant(t) )
- {
- for ( i = 0; i < (1UL << page_order); i++ )
-@@ -2579,6 +2582,7 @@ guest_physmap_add_entry(struct p2m_domai
- }
- }
-
-+out:
- audit_p2m(p2m, 1);
- p2m_unlock(p2m);
-
diff --git a/utils/xen/xsa-23.patch b/utils/xen/xsa-23.patch
deleted file mode 100644
index 82cb8b9..0000000
--- a/utils/xen/xsa-23.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-xen/mm/shadow: check toplevel pagetables are present before unhooking them.
-
-If the guest has not fully populated its top-level PAE entries when it calls
-HVMOP_pagetable_dying, the shadow code could try to unhook entries from
-MFN 0. Add a check to avoid that case.
-
-This issue was introduced by c/s 21239:b9d2db109cf5.
-
-This is a security problem, XSA-23 / CVE-2012-4538.
-
-Signed-off-by: Tim Deegan <tim AT xen.org>
-Tested-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff -r bfd22d40db06 xen/arch/x86/mm/shadow/multi.c
---- a/xen/arch/x86/mm/shadow/multi.c
-+++ b/xen/arch/x86/mm/shadow/multi.c
-@@ -4737,8 +4737,12 @@ static void sh_pagetable_dying(struct vc
- }
- for ( i = 0; i < 4; i++ )
- {
-- if ( fast_path )
-- smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
-+ if ( fast_path ) {
-+ if ( pagetable_is_null(v->arch.shadow_table[i]) )
-+ smfn = _mfn(INVALID_MFN);
-+ else
-+ smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
-+ }
- else
- {
- /* retrieving the l2s */
diff --git a/utils/xen/xsa-24.patch b/utils/xen/xsa-24.patch
deleted file mode 100644
index e46f513..0000000
--- a/utils/xen/xsa-24.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-compat/gnttab: Prevent infinite loop in compat code
-
-c/s 20281:95ea2052b41b, which introduces Grant Table version 2
-hypercalls introduces a vulnerability whereby the compat hypercall
-handler can fall into an infinite loop.
-
-If the watchdog is enabled, Xen will die after the timeout.
-
-This is a security problem, XSA-24 / CVE-2012-4539.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
-Acked-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-diff -r bac883cf805a xen/common/compat/grant_table.c
---- a/xen/common/compat/grant_table.c
-+++ b/xen/common/compat/grant_table.c
-@@ -318,6 +318,8 @@ int compat_grant_table_op(unsigned int c
- #undef XLAT_gnttab_get_status_frames_HNDL_frame_list
- if ( unlikely(__copy_to_guest(cmp_uop, &cmp.get_status, 1))
)
- rc = -EFAULT;
-+ else
-+ i = 1;
- }
- break;
- }
diff --git a/utils/xen/xsa-25.patch b/utils/xen/xsa-25.patch
deleted file mode 100644
index f8a9be2..0000000
--- a/utils/xen/xsa-25.patch
+++ /dev/null
@@ -1,461 +0,0 @@
-libxc: builder: limit maximum size of kernel/ramdisk.
-
-Allowing user supplied kernels of arbitrary sizes, especially during
-decompression, can swallow up dom0 memory leading to either virtual
-address space exhaustion in the builder process or allocation
-failures/OOM killing of both toolstack and unrelated processes.
-
-We disable these checks when building in a stub domain for pvgrub
-since this uses the guest's own memory and is isolated.
-
-Decompression of gzip compressed kernels and ramdisks has been safe
-since 14954:58205257517d (Xen 3.1.0 onwards).
-
-This is XSA-25 / CVE-2012-4544.
-
-Also make explicit checks for buffer overflows in various
-decompression routines. These were already ruled out due to other
-properties of the code but check them as a belt-and-braces measure.
-
-Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-[ Includes 25589:60f09d1ab1fe for CVE-2012-2625 ]
-
-diff --git a/stubdom/grub/kexec.c b/stubdom/grub/kexec.c
-index 06bef52..b21c91a 100644
---- a/stubdom/grub/kexec.c
-+++ b/stubdom/grub/kexec.c
-@@ -137,6 +137,10 @@ void kexec(void *kernel, long kernel_size, void
*module, long module_size, char
- dom = xc_dom_allocate(xc_handle, cmdline, features);
- dom->allocate = kexec_allocate;
-
-+ /* We are using guest owned memory, therefore no limits. */
-+ xc_dom_kernel_max_size(dom, 0);
-+ xc_dom_ramdisk_max_size(dom, 0);
-+
- dom->kernel_blob = kernel;
- dom->kernel_size = kernel_size;
-
-diff --git a/tools/libxc/xc_dom.h b/tools/libxc/xc_dom.h
-index e72f066..7043f96 100644
---- a/tools/libxc/xc_dom.h
-+++ b/tools/libxc/xc_dom.h
-@@ -52,6 +52,9 @@ struct xc_dom_image {
- void *ramdisk_blob;
- size_t ramdisk_size;
-
-+ size_t max_kernel_size;
-+ size_t max_ramdisk_size;
-+
- /* arguments and parameters */
- char *cmdline;
- uint32_t f_requested[XENFEAT_NR_SUBMAPS];
-@@ -175,6 +178,23 @@ void xc_dom_release_phys(struct xc_dom_image *dom);
- void xc_dom_release(struct xc_dom_image *dom);
- int xc_dom_mem_init(struct xc_dom_image *dom, unsigned int mem_mb);
-
-+/* Set this larger if you have enormous ramdisks/kernels. Note that
-+ * you should trust all kernels not to be maliciously large (e.g. to
-+ * exhaust all dom0 memory) if you do this (see CVE-2012-4544 /
-+ * XSA-25). You can also set the default independently for
-+ * ramdisks/kernels in xc_dom_allocate() or call
-+ * xc_dom_{kernel,ramdisk}_max_size.
-+ */
-+#ifndef XC_DOM_DECOMPRESS_MAX
-+#define XC_DOM_DECOMPRESS_MAX (1024*1024*1024) /* 1GB */
-+#endif
-+
-+int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz);
-+int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz);
-+
-+int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz);
-+int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz);
-+
- size_t xc_dom_check_gzip(xc_interface *xch,
- void *blob, size_t ziplen);
- int xc_dom_do_gunzip(xc_interface *xch,
-@@ -224,7 +244,8 @@ void xc_dom_log_memory_footprint(struct xc_dom_image
*dom);
- void *xc_dom_malloc(struct xc_dom_image *dom, size_t size);
- void *xc_dom_malloc_page_aligned(struct xc_dom_image *dom, size_t size);
- void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
-- const char *filename, size_t * size);
-+ const char *filename, size_t * size,
-+ const size_t max_size);
- char *xc_dom_strdup(struct xc_dom_image *dom, const char *str);
-
- /* --- alloc memory pool ------------------------------------------- */
-diff --git a/tools/libxc/xc_dom_bzimageloader.c
b/tools/libxc/xc_dom_bzimageloader.c
-index 9852e67..73cfad1 100644
---- a/tools/libxc/xc_dom_bzimageloader.c
-+++ b/tools/libxc/xc_dom_bzimageloader.c
-@@ -47,13 +47,19 @@ static int xc_try_bzip2_decode(
- char *out_buf;
- char *tmp_buf;
- int retval = -1;
-- int outsize;
-+ unsigned int outsize;
- uint64_t total;
-
- stream.bzalloc = NULL;
- stream.bzfree = NULL;
- stream.opaque = NULL;
-
-+ if ( dom->kernel_size == 0)
-+ {
-+ DOMPRINTF("BZIP2: Input is 0 size");
-+ return -1;
-+ }
-+
- ret = BZ2_bzDecompressInit(&stream, 0, 0);
- if ( ret != BZ_OK )
- {
-@@ -66,6 +72,17 @@ static int xc_try_bzip2_decode(
- * the input buffer to start, and we'll realloc as needed.
- */
- outsize = dom->kernel_size;
-+
-+ /*
-+ * stream.avail_in and outsize are unsigned int, while kernel_size
-+ * is a size_t. Check we aren't overflowing.
-+ */
-+ if ( outsize != dom->kernel_size )
-+ {
-+ DOMPRINTF("BZIP2: Input too large");
-+ goto bzip2_cleanup;
-+ }
-+
- out_buf = malloc(outsize);
- if ( out_buf == NULL )
- {
-@@ -98,13 +115,20 @@ static int xc_try_bzip2_decode(
- if ( stream.avail_out == 0 )
- {
- /* Protect against output buffer overflow */
-- if ( outsize > INT_MAX / 2 )
-+ if ( outsize > UINT_MAX / 2 )
- {
- DOMPRINTF("BZIP2: output buffer overflow");
- free(out_buf);
- goto bzip2_cleanup;
- }
-
-+ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
-+ {
-+ DOMPRINTF("BZIP2: output too large");
-+ free(out_buf);
-+ goto bzip2_cleanup;
-+ }
-+
- tmp_buf = realloc(out_buf, outsize * 2);
- if ( tmp_buf == NULL )
- {
-@@ -172,9 +196,15 @@ static int xc_try_lzma_decode(
- unsigned char *out_buf;
- unsigned char *tmp_buf;
- int retval = -1;
-- int outsize;
-+ size_t outsize;
- const char *msg;
-
-+ if ( dom->kernel_size == 0)
-+ {
-+ DOMPRINTF("LZMA: Input is 0 size");
-+ return -1;
-+ }
-+
- ret = lzma_alone_decoder(&stream, 128*1024*1024);
- if ( ret != LZMA_OK )
- {
-@@ -251,13 +281,20 @@ static int xc_try_lzma_decode(
- if ( stream.avail_out == 0 )
- {
- /* Protect against output buffer overflow */
-- if ( outsize > INT_MAX / 2 )
-+ if ( outsize > SIZE_MAX / 2 )
- {
- DOMPRINTF("LZMA: output buffer overflow");
- free(out_buf);
- goto lzma_cleanup;
- }
-
-+ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
-+ {
-+ DOMPRINTF("LZMA: output too large");
-+ free(out_buf);
-+ goto lzma_cleanup;
-+ }
-+
- tmp_buf = realloc(out_buf, outsize * 2);
- if ( tmp_buf == NULL )
- {
-@@ -327,6 +364,12 @@ static int xc_try_lzo1x_decode(
- 0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
- };
-
-+ /*
-+ * lzo_uint should match size_t. Check that this is the case to be
-+ * sure we won't overflow various lzo_uint fields.
-+ */
-+ XC_BUILD_BUG_ON(sizeof(lzo_uint) != sizeof(size_t));
-+
- ret = lzo_init();
- if ( ret != LZO_E_OK )
- {
-@@ -406,6 +449,14 @@ static int xc_try_lzo1x_decode(
- if ( src_len <= 0 || src_len > dst_len || src_len > left )
- break;
-
-+ msg = "Output buffer overflow";
-+ if ( *size > SIZE_MAX - dst_len )
-+ break;
-+
-+ msg = "Decompressed image too large";
-+ if ( xc_dom_kernel_check_size(dom, *size + dst_len) )
-+ break;
-+
- msg = "Failed to (re)alloc memory";
- tmp_buf = realloc(out_buf, *size + dst_len);
- if ( tmp_buf == NULL )
-diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
-index fea9de5..2a01d7c 100644
---- a/tools/libxc/xc_dom_core.c
-+++ b/tools/libxc/xc_dom_core.c
-@@ -159,7 +159,8 @@ void *xc_dom_malloc_page_aligned(struct xc_dom_image
*dom, size_t size)
- }
-
- void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
-- const char *filename, size_t * size)
-+ const char *filename, size_t * size,
-+ const size_t max_size)
- {
- struct xc_dom_mem *block = NULL;
- int fd = -1;
-@@ -171,6 +172,13 @@ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
- lseek(fd, 0, SEEK_SET);
- *size = lseek(fd, 0, SEEK_END);
-
-+ if ( max_size && *size > max_size )
-+ {
-+ xc_dom_panic(dom->xch, XC_OUT_OF_MEMORY,
-+ "tried to map file which is too large");
-+ goto err;
-+ }
-+
- block = malloc(sizeof(*block));
- if ( block == NULL )
- goto err;
-@@ -222,6 +230,40 @@ char *xc_dom_strdup(struct xc_dom_image *dom, const
char *str)
- }
-
- /* ------------------------------------------------------------------------
*/
-+/* decompression buffer sizing
*/
-+int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz)
-+{
-+ /* No limit */
-+ if ( !dom->max_kernel_size )
-+ return 0;
-+
-+ if ( sz > dom->max_kernel_size )
-+ {
-+ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
-+ "kernel image too large");
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz)
-+{
-+ /* No limit */
-+ if ( !dom->max_ramdisk_size )
-+ return 0;
-+
-+ if ( sz > dom->max_ramdisk_size )
-+ {
-+ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
-+ "ramdisk image too large");
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+/* ------------------------------------------------------------------------
*/
- /* read files, copy memory blocks, with transparent gunzip
*/
-
- size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen)
-@@ -235,7 +277,7 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob,
size_t ziplen)
-
- gzlen = blob + ziplen - 4;
- unziplen = gzlen[3] << 24 | gzlen[2] << 16 | gzlen[1] << 8 | gzlen[0];
-- if ( (unziplen < 0) || (unziplen > (1024*1024*1024)) ) /* 1GB limit */
-+ if ( (unziplen < 0) || (unziplen > XC_DOM_DECOMPRESS_MAX) )
- {
- xc_dom_printf
- (xch,
-@@ -288,6 +330,9 @@ int xc_dom_try_gunzip(struct xc_dom_image *dom, void
**blob, size_t * size)
- if ( unziplen == 0 )
- return 0;
-
-+ if ( xc_dom_kernel_check_size(dom, unziplen) )
-+ return 0;
-+
- unzip = xc_dom_malloc(dom, unziplen);
- if ( unzip == NULL )
- return -1;
-@@ -588,6 +633,9 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
- memset(dom, 0, sizeof(*dom));
- dom->xch = xch;
-
-+ dom->max_kernel_size = XC_DOM_DECOMPRESS_MAX;
-+ dom->max_ramdisk_size = XC_DOM_DECOMPRESS_MAX;
-+
- if ( cmdline )
- dom->cmdline = xc_dom_strdup(dom, cmdline);
- if ( features )
-@@ -608,10 +656,25 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
- return NULL;
- }
-
-+int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz)
-+{
-+ DOMPRINTF("%s: kernel_max_size=%zx", __FUNCTION__, sz);
-+ dom->max_kernel_size = sz;
-+ return 0;
-+}
-+
-+int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz)
-+{
-+ DOMPRINTF("%s: ramdisk_max_size=%zx", __FUNCTION__, sz);
-+ dom->max_ramdisk_size = sz;
-+ return 0;
-+}
-+
- int xc_dom_kernel_file(struct xc_dom_image *dom, const char *filename)
- {
- DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
-- dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size);
-+ dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size,
-+ dom->max_kernel_size);
- if ( dom->kernel_blob == NULL )
- return -1;
- return xc_dom_try_gunzip(dom, &dom->kernel_blob, &dom->kernel_size);
-@@ -621,7 +684,9 @@ int xc_dom_ramdisk_file(struct xc_dom_image *dom, const
char *filename)
- {
- DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
- dom->ramdisk_blob =
-- xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size);
-+ xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size,
-+ dom->max_ramdisk_size);
-+
- if ( dom->ramdisk_blob == NULL )
- return -1;
- // return xc_dom_try_gunzip(dom, &dom->ramdisk_blob, &dom->ramdisk_size);
-@@ -781,7 +846,11 @@ int xc_dom_build_image(struct xc_dom_image *dom)
- void *ramdiskmap;
-
- unziplen = xc_dom_check_gzip(dom->xch, dom->ramdisk_blob,
dom->ramdisk_size);
-+ if ( xc_dom_ramdisk_check_size(dom, unziplen) != 0 )
-+ unziplen = 0;
-+
- ramdisklen = unziplen ? unziplen : dom->ramdisk_size;
-+
- if ( xc_dom_alloc_segment(dom, &dom->ramdisk_seg, "ramdisk", 0,
- ramdisklen) != 0 )
- goto err;
-diff --git a/tools/pygrub/src/pygrub b/tools/pygrub/src/pygrub
-index 17c0083..1a3c1c3 100644
---- a/tools/pygrub/src/pygrub
-+++ b/tools/pygrub/src/pygrub
-@@ -28,6 +28,7 @@ import grub.LiloConf
- import grub.ExtLinuxConf
-
- PYGRUB_VER = 0.6
-+FS_READ_MAX = 1024 * 1024
-
- def enable_cursor(ison):
- if ison:
-@@ -421,7 +422,8 @@ class Grub:
- if self.__dict__.get('cf', None) is None:
- raise RuntimeError, "couldn't find bootloader config file in
the image provided."
- f = fs.open_file(self.cf.filename)
-- buf = f.read()
-+ # limit read size to avoid pathological cases
-+ buf = f.read(FS_READ_MAX)
- del f
- self.cf.parse(buf)
-
-@@ -670,6 +672,37 @@ if __name__ == "__main__":
- def usage():
- print >> sys.stderr, "Usage: %s [-q|--quiet] [-i|--interactive]
[-n|--not-really] [--output=] [--kernel=] [--ramdisk=] [--args=] [--entry=]
[--output-directory=] [--output-format=sxp|simple|simple0] <image>"
%(sys.argv[0],)
-
-+ def copy_from_image(fs, file_to_read, file_type, output_directory,
-+ not_really):
-+ if not_really:
-+ if fs.file_exists(file_to_read):
-+ return "<%s:%s>" % (file_type, file_to_read)
-+ else:
-+ sys.exit("The requested %s file does not exist" % file_type)
-+ try:
-+ datafile = fs.open_file(file_to_read)
-+ except Exception, e:
-+ print >>sys.stderr, e
-+ sys.exit("Error opening %s in guest" % file_to_read)
-+ (tfd, ret) = tempfile.mkstemp(prefix="boot_"+file_type+".",
-+ dir=output_directory)
-+ dataoff = 0
-+ while True:
-+ data = datafile.read(FS_READ_MAX, dataoff)
-+ if len(data) == 0:
-+ os.close(tfd)
-+ del datafile
-+ return ret
-+ try:
-+ os.write(tfd, data)
-+ except Exception, e:
-+ print >>sys.stderr, e
-+ os.close(tfd)
-+ os.unlink(ret)
-+ del datafile
-+ sys.exit("Error writing temporary copy of "+file_type)
-+ dataoff += len(data)
-+
- try:
- opts, args = getopt.gnu_getopt(sys.argv[1:], 'qinh::',
- ["quiet", "interactive", "not-really",
"help",
-@@ -786,24 +819,18 @@ if __name__ == "__main__":
- if not fs:
- raise RuntimeError, "Unable to find partition containing kernel"
-
-- if not_really:
-- bootcfg["kernel"] = "<kernel:%s>" % chosencfg["kernel"]
-- else:
-- data = fs.open_file(chosencfg["kernel"]).read()
-- (tfd, bootcfg["kernel"]) = tempfile.mkstemp(prefix="boot_kernel.",
-- dir=output_directory)
-- os.write(tfd, data)
-- os.close(tfd)
-+ bootcfg["kernel"] = copy_from_image(fs, chosencfg["kernel"], "kernel",
-+ output_directory, not_really)
-
- if chosencfg["ramdisk"]:
-- if not_really:
-- bootcfg["ramdisk"] = "<ramdisk:%s>" % chosencfg["ramdisk"]
-- else:
-- data = fs.open_file(chosencfg["ramdisk"],).read()
-- (tfd, bootcfg["ramdisk"]) = tempfile.mkstemp(
-- prefix="boot_ramdisk.", dir=output_directory)
-- os.write(tfd, data)
-- os.close(tfd)
-+ try:
-+ bootcfg["ramdisk"] = copy_from_image(fs, chosencfg["ramdisk"],
-+ "ramdisk",
output_directory,
-+ not_really)
-+ except:
-+ if not not_really:
-+ os.unlink(bootcfg["kernel"])
-+ raise
- else:
- initrd = None
-
diff --git a/utils/xen/xsa-26.patch b/utils/xen/xsa-26.patch
deleted file mode 100644
index e8b8e7d..0000000
--- a/utils/xen/xsa-26.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-gnttab: fix releasing of memory upon switches between versions
-
-gnttab_unpopulate_status_frames() incompletely freed the pages
-previously used as status frame in that they did not get removed from
-the domain's xenpage_list, thus causing subsequent list corruption
-when those pages did get allocated again for the same or another purpose.
-
-Similarly, grant_table_create() and gnttab_grow_table() both improperly
-clean up in the event of an error - pages already shared with the guest
-can't be freed by just passing them to free_xenheap_page(). Fix this by
-sharing the pages only after all allocations succeeded.
-
-This is CVE-2012-5510 / XSA-26.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
-index 6c0aa6f..a180aef 100644
---- a/xen/common/grant_table.c
-+++ b/xen/common/grant_table.c
-@@ -1126,12 +1126,13 @@ fault:
- }
-
- static int
--gnttab_populate_status_frames(struct domain *d, struct grant_table *gt)
-+gnttab_populate_status_frames(struct domain *d, struct grant_table *gt,
-+ unsigned int req_nr_frames)
- {
- unsigned i;
- unsigned req_status_frames;
-
-- req_status_frames = grant_to_status_frames(gt->nr_grant_frames);
-+ req_status_frames = grant_to_status_frames(req_nr_frames);
- for ( i = nr_status_frames(gt); i < req_status_frames; i++ )
- {
- if ( (gt->status[i] = alloc_xenheap_page()) == NULL )
-@@ -1162,7 +1163,12 @@ gnttab_unpopulate_status_frames(struct domain *d,
struct grant_table *gt)
-
- for ( i = 0; i < nr_status_frames(gt); i++ )
- {
-- page_set_owner(virt_to_page(gt->status[i]), dom_xen);
-+ struct page_info *pg = virt_to_page(gt->status[i]);
-+
-+ BUG_ON(page_get_owner(pg) != d);
-+ if ( test_and_clear_bit(_PGC_allocated, &pg->count_info) )
-+ put_page(pg);
-+ BUG_ON(pg->count_info & ~PGC_xen_heap);
- free_xenheap_page(gt->status[i]);
- gt->status[i] = NULL;
- }
-@@ -1200,19 +1206,18 @@ gnttab_grow_table(struct domain *d, unsigned int
req_nr_frames)
- clear_page(gt->shared_raw[i]);
- }
-
-- /* Share the new shared frames with the recipient domain */
-- for ( i = nr_grant_frames(gt); i < req_nr_frames; i++ )
-- gnttab_create_shared_page(d, gt, i);
--
-- gt->nr_grant_frames = req_nr_frames;
--
- /* Status pages - version 2 */
- if (gt->gt_version > 1)
- {
-- if ( gnttab_populate_status_frames(d, gt) )
-+ if ( gnttab_populate_status_frames(d, gt, req_nr_frames) )
- goto shared_alloc_failed;
- }
-
-+ /* Share the new shared frames with the recipient domain */
-+ for ( i = nr_grant_frames(gt); i < req_nr_frames; i++ )
-+ gnttab_create_shared_page(d, gt, i);
-+ gt->nr_grant_frames = req_nr_frames;
-+
- return 1;
-
- shared_alloc_failed:
-@@ -2134,7 +2139,7 @@
gnttab_set_version(XEN_GUEST_HANDLE(gnttab_set_version_t uop))
-
- if ( op.version == 2 && gt->gt_version < 2 )
- {
-- res = gnttab_populate_status_frames(d, gt);
-+ res = gnttab_populate_status_frames(d, gt, nr_grant_frames(gt));
- if ( res < 0)
- goto out_unlock;
- }
-@@ -2449,9 +2454,6 @@ grant_table_create(
- clear_page(t->shared_raw[i]);
- }
-
-- for ( i = 0; i < INITIAL_NR_GRANT_FRAMES; i++ )
-- gnttab_create_shared_page(d, t, i);
--
- /* Status pages for grant table - for version 2 */
- t->status = xmalloc_array(grant_status_t *,
- grant_to_status_frames(max_nr_grant_frames));
-@@ -2459,6 +2461,10 @@ grant_table_create(
- goto no_mem_4;
- memset(t->status, 0,
- grant_to_status_frames(max_nr_grant_frames) *
sizeof(t->status[0]));
-+
-+ for ( i = 0; i < INITIAL_NR_GRANT_FRAMES; i++ )
-+ gnttab_create_shared_page(d, t, i);
-+
- t->nr_status_frames = 0;
-
- /* Okay, install the structure. */
diff --git a/utils/xen/xsa-27.patch b/utils/xen/xsa-27.patch
deleted file mode 100644
index f0764cb..0000000
--- a/utils/xen/xsa-27.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-hvm: Limit the size of large HVM op batches
-
-Doing large p2m updates for HVMOP_track_dirty_vram without preemption
-ties up the physical processor. Integrating preemption into the p2m
-updates is hard so simply limit to 1GB which is sufficient for a 15000
-* 15000 * 32bpp framebuffer.
-
-For HVMOP_modified_memory and HVMOP_set_mem_type preemptible add the
-necessary machinery to handle preemption.
-
-This is CVE-2012-5511 / XSA-27.
-
-Signed-off-by: Tim Deegan <tim AT xen.org>
-Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-x86/paging: Don't allocate user-controlled amounts of stack memory.
-
-This is XSA-27 / CVE-2012-5511.
-
-Signed-off-by: Tim Deegan <tim AT xen.org>
-Acked-by: Jan Beulich <jbeulich AT suse.com>
-v2: Provide definition of GB to fix x86-32 compile.
-
-Signed-off-by: Jan Beulich <JBeulich AT suse.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-
-diff -r 5639047d6c9f xen/arch/x86/hvm/hvm.c
---- a/xen/arch/x86/hvm/hvm.c Mon Nov 19 09:43:48 2012 +0100
-+++ b/xen/arch/x86/hvm/hvm.c Mon Nov 19 16:00:33 2012 +0000
-@@ -3471,6 +3471,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
- if ( !is_hvm_domain(d) )
- goto param_fail2;
-
-+ if ( a.nr > GB(1) >> PAGE_SHIFT )
-+ goto param_fail2;
-+
- rc = xsm_hvm_param(d, op);
- if ( rc )
- goto param_fail2;
-@@ -3498,7 +3501,6 @@ long do_hvm_op(unsigned long op, XEN_GUE
- struct xen_hvm_modified_memory a;
- struct domain *d;
- struct p2m_domain *p2m;
-- unsigned long pfn;
-
- if ( copy_from_guest(&a, arg, 1) )
- return -EFAULT;
-@@ -3526,8 +3528,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
- goto param_fail3;
-
- p2m = p2m_get_hostp2m(d);
-- for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
-+ while ( a.nr > 0 )
- {
-+ unsigned long pfn = a.first_pfn;
- p2m_type_t t;
- mfn_t mfn = gfn_to_mfn(p2m, pfn, &t);
- if ( p2m_is_paging(t) )
-@@ -3548,6 +3551,19 @@ long do_hvm_op(unsigned long op, XEN_GUE
- /* don't take a long time and don't die either */
- sh_remove_shadows(d->vcpu[0], mfn, 1, 0);
- }
-+
-+ a.first_pfn++;
-+ a.nr--;
-+
-+ /* Check for continuation if it's not the last interation */
-+ if ( a.nr > 0 && hypercall_preempt_check() )
-+ {
-+ if ( copy_to_guest(arg, &a, 1) )
-+ rc = -EFAULT;
-+ else
-+ rc = -EAGAIN;
-+ break;
-+ }
- }
-
- param_fail3:
-@@ -3595,7 +3611,6 @@ long do_hvm_op(unsigned long op, XEN_GUE
- struct xen_hvm_set_mem_type a;
- struct domain *d;
- struct p2m_domain *p2m;
-- unsigned long pfn;
-
- /* Interface types to internal p2m types */
- p2m_type_t memtype[] = {
-@@ -3625,8 +3640,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
- goto param_fail4;
-
- p2m = p2m_get_hostp2m(d);
-- for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
-+ while ( a.nr > 0 )
- {
-+ unsigned long pfn = a.first_pfn;
- p2m_type_t t;
- p2m_type_t nt;
- mfn_t mfn;
-@@ -3662,6 +3678,19 @@ long do_hvm_op(unsigned long op, XEN_GUE
- goto param_fail4;
- }
- }
-+
-+ a.first_pfn++;
-+ a.nr--;
-+
-+ /* Check for continuation if it's not the last interation */
-+ if ( a.nr > 0 && hypercall_preempt_check() )
-+ {
-+ if ( copy_to_guest(arg, &a, 1) )
-+ rc = -EFAULT;
-+ else
-+ rc = -EAGAIN;
-+ goto param_fail4;
-+ }
- }
-
- rc = 0;
-diff -r 5639047d6c9f xen/arch/x86/mm/paging.c
---- a/xen/arch/x86/mm/paging.c Mon Nov 19 09:43:48 2012 +0100
-+++ b/xen/arch/x86/mm/paging.c Mon Nov 19 16:00:33 2012 +0000
-@@ -529,13 +529,18 @@ int paging_log_dirty_range(struct domain
-
- if ( !d->arch.paging.log_dirty.fault_count &&
- !d->arch.paging.log_dirty.dirty_count ) {
-- int size = (nr + BITS_PER_LONG - 1) / BITS_PER_LONG;
-- unsigned long zeroes[size];
-- memset(zeroes, 0x00, size * BYTES_PER_LONG);
-+ static uint8_t zeroes[PAGE_SIZE];
-+ int off, size;
-+
-+ size = ((nr + BITS_PER_LONG - 1) / BITS_PER_LONG) * sizeof (long);
- rv = 0;
-- if ( copy_to_guest_offset(dirty_bitmap, 0, (uint8_t *) zeroes,
-- size * BYTES_PER_LONG) != 0 )
-- rv = -EFAULT;
-+ for ( off = 0; !rv && off < size; off += sizeof zeroes )
-+ {
-+ int todo = min(size - off, (int) PAGE_SIZE);
-+ if ( copy_to_guest_offset(dirty_bitmap, off, zeroes, todo) )
-+ rv = -EFAULT;
-+ off += todo;
-+ }
- goto out;
- }
- d->arch.paging.log_dirty.fault_count = 0;
-diff -r 5639047d6c9f xen/include/asm-x86/config.h
---- a/xen/include/asm-x86/config.h Mon Nov 19 09:43:48 2012 +0100
-+++ b/xen/include/asm-x86/config.h Mon Nov 19 16:00:33 2012 +0000
-@@ -108,6 +108,9 @@ extern unsigned int trampoline_xen_phys_
- extern unsigned char trampoline_cpu_started;
- extern char wakeup_start[];
- extern unsigned int video_mode, video_flags;
-+
-+#define GB(_gb) (_gb ## UL << 30)
-+
- #endif
-
- #define asmlinkage
-@@ -123,7 +126,6 @@ extern unsigned int video_mode, video_fl
- #define PML4_ADDR(_slot) \
- ((((_slot ## UL) >> 8) * 0xffff000000000000UL) | \
- (_slot ## UL << PML4_ENTRY_BITS))
--#define GB(_gb) (_gb ## UL << 30)
- #else
- #define PML4_ENTRY_BYTES (1 << PML4_ENTRY_BITS)
- #define PML4_ADDR(_slot) \
diff --git a/utils/xen/xsa-28.patch b/utils/xen/xsa-28.patch
deleted file mode 100644
index fe4638e..0000000
--- a/utils/xen/xsa-28.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-x86/HVM: range check xen_hvm_set_mem_access.hvmmem_access before use
-
-Otherwise an out of bounds array access can happen if changing the
-default access is being requested, which - if it doesn't crash Xen -
-would subsequently allow reading arbitrary memory through
-HVMOP_get_mem_access (again, unless that operation crashes Xen).
-
-This is XSA-28 / CVE-2012-5512.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Tim Deegan <tim AT xen.org>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-
-diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
-index 66cf805..08b6418 100644
---- a/xen/arch/x86/hvm/hvm.c
-+++ b/xen/arch/x86/hvm/hvm.c
-@@ -3699,7 +3699,7 @@ long do_hvm_op(unsigned long op,
XEN_GUEST_HANDLE(void) arg)
- return rc;
-
- rc = -EINVAL;
-- if ( !is_hvm_domain(d) )
-+ if ( !is_hvm_domain(d) || a.hvmmem_access >= ARRAY_SIZE(memaccess) )
- goto param_fail5;
-
- p2m = p2m_get_hostp2m(d);
-@@ -3719,9 +3719,6 @@ long do_hvm_op(unsigned long op,
XEN_GUEST_HANDLE(void) arg)
- ((a.first_pfn + a.nr - 1) > domain_get_maximum_gpfn(d)) )
- goto param_fail5;
-
-- if ( a.hvmmem_access >= ARRAY_SIZE(memaccess) )
-- goto param_fail5;
--
- for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
- {
- p2m_type_t t;
diff --git a/utils/xen/xsa-29.patch b/utils/xen/xsa-29.patch
deleted file mode 100644
index f8f6e38..0000000
--- a/utils/xen/xsa-29.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-xen: add missing guest address range checks to XENMEM_exchange handlers
-
-Ever since its existence (3.0.3 iirc) the handler for this has been
-using non address range checking guest memory accessors (i.e.
-the ones prefixed with two underscores) without first range
-checking the accessed space (via guest_handle_okay()), allowing
-a guest to access and overwrite hypervisor memory.
-
-This is XSA-29 / CVE-2012-5513.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
-index 2402984..1d877fc 100644
---- a/xen/common/compat/memory.c
-+++ b/xen/common/compat/memory.c
-@@ -114,6 +114,12 @@ int compat_memory_op(unsigned int cmd,
XEN_GUEST_HANDLE(void) compat)
- (cmp.xchg.out.nr_extents << cmp.xchg.out.extent_order)) )
- return -EINVAL;
-
-+ if ( !compat_handle_okay(cmp.xchg.in.extent_start,
-+ cmp.xchg.in.nr_extents) ||
-+ !compat_handle_okay(cmp.xchg.out.extent_start,
-+ cmp.xchg.out.nr_extents) )
-+ return -EFAULT;
-+
- start_extent = cmp.xchg.nr_exchanged;
- end_extent = (COMPAT_ARG_XLAT_SIZE - sizeof(*nat.xchg)) /
- (((1U << ABS(order_delta)) + 1) *
-diff --git a/xen/common/memory.c b/xen/common/memory.c
-index 4e7c234..59379d3 100644
---- a/xen/common/memory.c
-+++ b/xen/common/memory.c
-@@ -289,6 +289,13 @@ static long
memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
- goto fail_early;
- }
-
-+ if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) ||
-+ !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) )
-+ {
-+ rc = -EFAULT;
-+ goto fail_early;
-+ }
-+
- /* Only privileged guests can allocate multi-page contiguous extents. */
- if ( !multipage_allocation_permitted(current->domain,
- exch.in.extent_order) ||
diff --git a/utils/xen/xsa-30.patch b/utils/xen/xsa-30.patch
deleted file mode 100644
index 817879a..0000000
--- a/utils/xen/xsa-30.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-xen: fix error handling of guest_physmap_mark_populate_on_demand()
-
-The only user of the "out" label bypasses a necessary unlock, thus
-enabling the caller to lock up Xen.
-
-Also, the function was never meant to be called by a guest for itself,
-so rather than inspecting the code paths in depth for potential other
-problems this might cause, and adjusting e.g. the non-guest printk()
-in the above error path, just disallow the guest access to it.
-
-Finally, the printk() (considering its potential of spamming the log,
-the more that it's not using XENLOG_GUEST), is being converted to
-P2M_DEBUG(), as debugging is what it apparently was added for in the
-first place.
-
-This is XSA-30 / CVE-2012-5514.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Ian Campbell <ian.campbell AT citrix.com>
-Acked-by: George Dunlap <george.dunlap AT eu.citrix.com>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-diff -r 5639047d6c9f xen/arch/x86/mm/p2m.c
---- a/xen/arch/x86/mm/p2m.c Mon Nov 19 09:43:48 2012 +0100
-+++ b/xen/arch/x86/mm/p2m.c Thu Nov 22 17:07:37 2012 +0000
-@@ -2412,6 +2412,9 @@ guest_physmap_mark_populate_on_demand(st
- mfn_t omfn;
- int rc = 0;
-
-+ if ( !IS_PRIV_FOR(current->domain, d) )
-+ return -EPERM;
-+
- if ( !paging_mode_translate(d) )
- return -EINVAL;
-
-@@ -2430,8 +2433,7 @@ guest_physmap_mark_populate_on_demand(st
- omfn = gfn_to_mfn_query(p2m, gfn + i, &ot);
- if ( p2m_is_ram(ot) )
- {
-- printk("%s: gfn_to_mfn returned type %d!\n",
-- __func__, ot);
-+ P2M_DEBUG("gfn_to_mfn returned type %d!\n", ot);
- rc = -EBUSY;
- goto out;
- }
-@@ -2453,10 +2455,10 @@ guest_physmap_mark_populate_on_demand(st
- BUG_ON(p2m->pod.entry_count < 0);
- }
-
-+out:
- audit_p2m(p2m, 1);
- p2m_unlock(p2m);
-
--out:
- return rc;
- }
-
diff --git a/utils/xen/xsa-31.patch b/utils/xen/xsa-31.patch
deleted file mode 100644
index 1f3d929..0000000
--- a/utils/xen/xsa-31.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-memop: limit guest specified extent order
-
-Allowing unbounded order values here causes almost unbounded loops
-and/or partially incomplete requests, particularly in PoD code.
-
-The added range checks in populate_physmap(), decrease_reservation(),
-and the "in" one in memory_exchange() architecturally all could use
-PADDR_BITS - PAGE_SHIFT, and are being artificially constrained to
-MAX_ORDER.
-
-This is XSA-31 / CVE-2012-5515.
-
-Signed-off-by: Jan Beulich <jbeulich AT suse.com>
-Acked-by: Tim Deegan <tim AT xen.org>
-Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
-
-diff --git a/xen/common/memory.c b/xen/common/memory.c
-index 4e7c234..9b9fb18 100644
---- a/xen/common/memory.c
-+++ b/xen/common/memory.c
-@@ -117,7 +117,8 @@ static void populate_physmap(struct memop_args *a)
-
- if ( a->memflags & MEMF_populate_on_demand )
- {
-- if ( guest_physmap_mark_populate_on_demand(d, gpfn,
-+ if ( a->extent_order > MAX_ORDER ||
-+ guest_physmap_mark_populate_on_demand(d, gpfn,
- a->extent_order) < 0
)
- goto out;
- }
-@@ -216,7 +217,8 @@ static void decrease_reservation(struct memop_args *a)
- xen_pfn_t gmfn;
-
- if ( !guest_handle_subrange_okay(a->extent_list, a->nr_done,
-- a->nr_extents-1) )
-+ a->nr_extents-1) ||
-+ a->extent_order > MAX_ORDER )
- return;
-
- for ( i = a->nr_done; i < a->nr_extents; i++ )
-@@ -278,6 +280,9 @@ static long
memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
- if ( (exch.nr_exchanged > exch.in.nr_extents) ||
- /* Input and output domain identifiers match? */
- (exch.in.domid != exch.out.domid) ||
-+ /* Extent orders are sensible? */
-+ (exch.in.extent_order > MAX_ORDER) ||
-+ (exch.out.extent_order > MAX_ORDER) ||
- /* Sizes of input and output lists do not overflow a long? */
- ((~0UL >> exch.in.extent_order) < exch.in.nr_extents) ||
- ((~0UL >> exch.out.extent_order) < exch.out.nr_extents) ||



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8e8fb99a39c6c1dc82740eabf8778cccfe0f6b49), Vlad Glagolev, 12/22/2012

Archive powered by MHonArc 2.6.24.

Top of Page