linux-kernel - Re: [PATCH] xen/arm: call uaccess_ttbr0_enable for dm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <212b2be3-5841-4e7f-84d7-4b3653054481@suse.com>
Date: Thu, 15 May 2025 13:33:19 +0200
From: Jürgen Groß <jgross@...e.com>
To: Stefano Stabellini <sstabellini@...nel.org>,
 xen-devel@...ts.xenproject.org
Cc: Julien Grall <julien@....org>, Bertrand Marquis
 <bertrand.marquis@....com>, Michal Orzel <michal.orzel@....com>,
 Volodymyr Babchuk <Volodymyr_Babchuk@...m.com>,
 linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [PATCH] xen/arm: call uaccess_ttbr0_enable for dm_op hypercall

On 12.05.25 23:54, Stefano Stabellini wrote:
> From: Stefano Stabellini <stefano.stabellini@....com>
> 
> dm_op hypercalls might come from userspace and pass memory addresses as
> parameters. The memory addresses typically correspond to buffers
> allocated in userspace to hold extra hypercall parameters.
> 
> On ARM, when CONFIG_ARM64_SW_TTBR0_PAN is enabled, they might not be
> accessible by Xen, as a result ioreq hypercalls might fail. See the
> existing comment in arch/arm64/xen/hypercall.S regarding privcmd_call
> for reference.
> 
> For privcmd_call, Linux calls uaccess_ttbr0_enable before issuing the
> hypercall thanks to commit 9cf09d68b89a. We need to do the same for
> dm_op. This resolves the problem.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@....com>
> Fixes: 9cf09d68b89a ("arm64: xen: Enable user access before a privcmd
> hvc call")
> Cc: stable@...nel.org

I'm not an Arm specialist, but looking at the surrounding code this
seems to be correct.

Reviewed-by: Juergen Gross <jgross@...e.com>


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3684 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (496 bytes)