linux-kernel - [PATCH] xen: grant-table: Check truncation when giving access to a frame

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 13 Jun 2016 11:50:46 +0100
From:	Julien Grall <julien.grall@....com>
To:	boris.ostrovsky@...cle.com, david.vrabel@...rix.com,
	jgross@...e.com, sstabellini@...nel.org, konrad.wilk@...cle.com
Cc:	steve.capper@....com, linux-kernel@...r.kernel.org,
	xen-devel@...ts.xen.org, andrew.cooper3@...rix.com,
	JBeulich@...e.com, Julien Grall <julien.grall@....com>
Subject: [PATCH] xen: grant-table: Check truncation when giving access to a frame

The version 1 of the grant-table protocol only supports frame encoded on
32-bit.

When the platform is supporting 48-bit physical address, the frame will
be encoded on 36-bit which will lead a truncation and give access to
the wrong frame.

On ARM Xen will always allow the guest to use all the physical address,
although today the RAM is always located under 40-bits (see
xen/include/public/arch-arm.h).

Add a truncation check in gnttab_update_entry_v1 to prevent the guest to
give access to the wrong frame.

Signed-off-by: Julien Grall <julien.grall@....com>

---
    This is limiting us to a 44-bit address space whilst ARM can support
    up to 48-bit today. This number of bit will increase to 52-bit in
    upcoming processors [1].

    It might be good to start thinking to extend the version 1 of the
    protocol to use 64-bit frame number.

    [1] https://community.arm.com/groups/processors/blog/2016/01/05/armv8-a-architecture-evolution
---
 drivers/xen/grant-table.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index bb36b1e..f47c2e99 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -224,6 +224,13 @@ static void gnttab_update_entry_v1(grant_ref_t ref, domid_t domid,
 {
 	gnttab_shared.v1[ref].domid = domid;
 	gnttab_shared.v1[ref].frame = frame;
+
+	/*
+	 * V1 only supports 32-bit frame, check the truncation
+	 * to avoid giving access to the wrong frame.
+	 */
+	BUG_ON(gnttab_shared.v1[ref].frame != frame);
+
 	wmb();
 	gnttab_shared.v1[ref].flags = flags;
 }
-- 
1.9.1