History

Merge tag 'xsa-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen security fixes from Juergen Gross: - XSA-403 (4 patches for blkfront and netfront drivers): Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). - XSA-405 (1 patch for netfront driver, only 5.10 and newer): While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed. - XSA-406 (1 patch for Arm specific dom0 code): When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages. * tag 'xsa-5.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/arm: Fix race in RB-tree based P2M accounting xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() xen/blkfront: force data bouncing when backend is untrusted xen/netfront: force data bouncing when backend is untrusted xen/netfront: fix leaking data in shared pages xen/blkfront: fix leaking data in shared pages

Linus Torvalds committed 4 years ago

Commit e35e5b62 parents c1084b6 b75cd213 files · +93 −23Browse files

Unified · Split

3 files
  1. arch/arm/xen/p2m.c +4 −2
  2. drivers/block/xen-blkfront.c +37 −17
  3. drivers/net/xen-netfront.c +52 −4
arch/arm/xen/p2m.c+4−2
@@ -63,11 +63,12 @@ out: · 62 unmodified lines
63 63
64unsigned long __pfn_to_mfn(unsigned long pfn)64unsigned long __pfn_to_mfn(unsigned long pfn)
65{65{
66 struct rb_node *n = phys_to_mach.rb_node;66 struct rb_node *n;
67 struct xen_p2m_entry *entry;67 struct xen_p2m_entry *entry;
68 unsigned long irqflags;68 unsigned long irqflags;
69 69
70 read_lock_irqsave(&p2m_lock, irqflags);70 read_lock_irqsave(&p2m_lock, irqflags);
71 n = phys_to_mach.rb_node;
71 while (n) {72 while (n) {
72 entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);73 entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);
73 if (entry->pfn <= pfn &&74 if (entry->pfn <= pfn &&
@@ -152,10 +153,11 @@ bool __set_phys_to_machine_multi(unsigned long pfn, · 78 unmodified lines
152 int rc;153 int rc;
153 unsigned long irqflags;154 unsigned long irqflags;
154 struct xen_p2m_entry *p2m_entry;155 struct xen_p2m_entry *p2m_entry;
155 struct rb_node *n = phys_to_mach.rb_node;156 struct rb_node *n;
156 157
157 if (mfn == INVALID_P2M_ENTRY) {158 if (mfn == INVALID_P2M_ENTRY) {
158 write_lock_irqsave(&p2m_lock, irqflags);159 write_lock_irqsave(&p2m_lock, irqflags);
160 n = phys_to_mach.rb_node;
159 while (n) {161 while (n) {
160 p2m_entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);162 p2m_entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);
161 if (p2m_entry->pfn <= pfn &&163 if (p2m_entry->pfn <= pfn &&
drivers/block/xen-blkfront.c+37−17
@@ -152,6 +152,10 @@ static unsigned int xen_blkif_max_ring_order; · 151 unmodified lines
152module_param_named(max_ring_page_order, xen_blkif_max_ring_order, int, 0444);152module_param_named(max_ring_page_order, xen_blkif_max_ring_order, int, 0444);
153MODULE_PARM_DESC(max_ring_page_order, "Maximum order of pages to be used for the shared ring");153MODULE_PARM_DESC(max_ring_page_order, "Maximum order of pages to be used for the shared ring");
154 154
155static bool __read_mostly xen_blkif_trusted = true;
156module_param_named(trusted, xen_blkif_trusted, bool, 0644);
157MODULE_PARM_DESC(trusted, "Is the backend trusted");
158
155#define BLK_RING_SIZE(info) \159#define BLK_RING_SIZE(info) \
156 __CONST_RING_SIZE(blkif, XEN_PAGE_SIZE * (info)->nr_ring_pages)160 __CONST_RING_SIZE(blkif, XEN_PAGE_SIZE * (info)->nr_ring_pages)
157 161
@@ -210,6 +214,7 @@ struct blkfront_info · 52 unmodified lines
210 unsigned int feature_discard:1;214 unsigned int feature_discard:1;
211 unsigned int feature_secdiscard:1;215 unsigned int feature_secdiscard:1;
212 unsigned int feature_persistent:1;216 unsigned int feature_persistent:1;
217 unsigned int bounce:1;
213 unsigned int discard_granularity;218 unsigned int discard_granularity;
214 unsigned int discard_alignment;219 unsigned int discard_alignment;
215 /* Number of 4KB segments handled */220 /* Number of 4KB segments handled */
@@ -310,8 +315,8 @@ static int fill_grant_buffer(struct blkfront_ring_info *rinfo, int num) · 94 unmodified lines
310 if (!gnt_list_entry)315 if (!gnt_list_entry)
311 goto out_of_memory;316 goto out_of_memory;
312 317
313 if (info->feature_persistent) {318 if (info->bounce) {
314 granted_page = alloc_page(GFP_NOIO);319 granted_page = alloc_page(GFP_NOIO | __GFP_ZERO);
315 if (!granted_page) {320 if (!granted_page) {
316 kfree(gnt_list_entry);321 kfree(gnt_list_entry);
317 goto out_of_memory;322 goto out_of_memory;
@@ -330,7 +335,7 @@ out_of_memory: · 12 unmodified lines
330 list_for_each_entry_safe(gnt_list_entry, n,335 list_for_each_entry_safe(gnt_list_entry, n,
331 &rinfo->grants, node) {336 &rinfo->grants, node) {
332 list_del(&gnt_list_entry->node);337 list_del(&gnt_list_entry->node);
333 if (info->feature_persistent)338 if (info->bounce)
334 __free_page(gnt_list_entry->page);339 __free_page(gnt_list_entry->page);
335 kfree(gnt_list_entry);340 kfree(gnt_list_entry);
336 i--;341 i--;
@@ -376,7 +381,7 @@ static struct grant *get_grant(grant_ref_t *gref_head, · 39 unmodified lines
376 /* Assign a gref to this page */381 /* Assign a gref to this page */
377 gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);382 gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
378 BUG_ON(gnt_list_entry->gref == -ENOSPC);383 BUG_ON(gnt_list_entry->gref == -ENOSPC);
379 if (info->feature_persistent)384 if (info->bounce)
380 grant_foreign_access(gnt_list_entry, info);385 grant_foreign_access(gnt_list_entry, info);
381 else {386 else {
382 /* Grant access to the GFN passed by the caller */387 /* Grant access to the GFN passed by the caller */
@@ -400,7 +405,7 @@ static struct grant *get_indirect_grant(grant_ref_t *gref_head, · 17 unmodified lines
400 /* Assign a gref to this page */405 /* Assign a gref to this page */
401 gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);406 gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
402 BUG_ON(gnt_list_entry->gref == -ENOSPC);407 BUG_ON(gnt_list_entry->gref == -ENOSPC);
403 if (!info->feature_persistent) {408 if (!info->bounce) {
404 struct page *indirect_page;409 struct page *indirect_page;
405 410
406 /* Fetch a pre-allocated page to use for indirect grefs */411 /* Fetch a pre-allocated page to use for indirect grefs */
@@ -703,7 +708,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri · 296 unmodified lines
703 .grant_idx = 0,708 .grant_idx = 0,
704 .segments = NULL,709 .segments = NULL,
705 .rinfo = rinfo,710 .rinfo = rinfo,
706 .need_copy = rq_data_dir(req) && info->feature_persistent,711 .need_copy = rq_data_dir(req) && info->bounce,
707 };712 };
708 713
709 /*714 /*
@@ -981,11 +986,12 @@ static void xlvbd_flush(struct blkfront_info *info) · 271 unmodified lines
981{986{
982 blk_queue_write_cache(info->rq, info->feature_flush ? true : false,987 blk_queue_write_cache(info->rq, info->feature_flush ? true : false,
983 info->feature_fua ? true : false);988 info->feature_fua ? true : false);
984 pr_info("blkfront: %s: %s %s %s %s %s\n",989 pr_info("blkfront: %s: %s %s %s %s %s %s %s\n",
985 info->gd->disk_name, flush_info(info),990 info->gd->disk_name, flush_info(info),
986 "persistent grants:", info->feature_persistent ?991 "persistent grants:", info->feature_persistent ?
987 "enabled;" : "disabled;", "indirect descriptors:",992 "enabled;" : "disabled;", "indirect descriptors:",
988 info->max_indirect_segments ? "enabled;" : "disabled;");993 info->max_indirect_segments ? "enabled;" : "disabled;",
994 "bounce buffer:", info->bounce ? "enabled" : "disabled;");
989}995}
990 996
991static int xen_translate_vdev(int vdevice, int *minor, unsigned int *offset)997static int xen_translate_vdev(int vdevice, int *minor, unsigned int *offset)
@@ -1207,7 +1213,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo) · 215 unmodified lines
1207 if (!list_empty(&rinfo->indirect_pages)) {1213 if (!list_empty(&rinfo->indirect_pages)) {
1208 struct page *indirect_page, *n;1214 struct page *indirect_page, *n;
1209 1215
1210 BUG_ON(info->feature_persistent);1216 BUG_ON(info->bounce);
1211 list_for_each_entry_safe(indirect_page, n, &rinfo->indirect_pages, lru) {1217 list_for_each_entry_safe(indirect_page, n, &rinfo->indirect_pages, lru) {
1212 list_del(&indirect_page->lru);1218 list_del(&indirect_page->lru);
1213 __free_page(indirect_page);1219 __free_page(indirect_page);
@@ -1224,7 +1230,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo) · 10 unmodified lines
1224 NULL);1230 NULL);
1225 rinfo->persistent_gnts_c--;1231 rinfo->persistent_gnts_c--;
1226 }1232 }
1227 if (info->feature_persistent)1233 if (info->bounce)
1228 __free_page(persistent_gnt->page);1234 __free_page(persistent_gnt->page);
1229 kfree(persistent_gnt);1235 kfree(persistent_gnt);
1230 }1236 }
@@ -1245,7 +1251,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo) · 14 unmodified lines
1245 for (j = 0; j < segs; j++) {1251 for (j = 0; j < segs; j++) {
1246 persistent_gnt = rinfo->shadow[i].grants_used[j];1252 persistent_gnt = rinfo->shadow[i].grants_used[j];
1247 gnttab_end_foreign_access(persistent_gnt->gref, NULL);1253 gnttab_end_foreign_access(persistent_gnt->gref, NULL);
1248 if (info->feature_persistent)1254 if (info->bounce)
1249 __free_page(persistent_gnt->page);1255 __free_page(persistent_gnt->page);
1250 kfree(persistent_gnt);1256 kfree(persistent_gnt);
1251 }1257 }
@@ -1428,7 +1434,7 @@ static int blkif_completion(unsigned long *id, · 176 unmodified lines
1428 data.s = s;1434 data.s = s;
1429 num_sg = s->num_sg;1435 num_sg = s->num_sg;
1430 1436
1431 if (bret->operation == BLKIF_OP_READ && info->feature_persistent) {1437 if (bret->operation == BLKIF_OP_READ && info->bounce) {
1432 for_each_sg(s->sg, sg, num_sg, i) {1438 for_each_sg(s->sg, sg, num_sg, i) {
1433 BUG_ON(sg->offset + sg->length > PAGE_SIZE);1439 BUG_ON(sg->offset + sg->length > PAGE_SIZE);
1434 1440
@@ -1487,7 +1493,7 @@ static int blkif_completion(unsigned long *id, · 52 unmodified lines
1487 * Add the used indirect page back to the list of1493 * Add the used indirect page back to the list of
1488 * available pages for indirect grefs.1494 * available pages for indirect grefs.
1489 */1495 */
1490 if (!info->feature_persistent) {1496 if (!info->bounce) {
1491 indirect_page = s->indirect_grants[i]->page;1497 indirect_page = s->indirect_grants[i]->page;
1492 list_add(&indirect_page->lru, &rinfo->indirect_pages);1498 list_add(&indirect_page->lru, &rinfo->indirect_pages);
1493 }1499 }
@@ -1764,6 +1770,10 @@ static int talk_to_blkback(struct xenbus_device *dev, · 270 unmodified lines
1764 if (!info)1770 if (!info)
1765 return -ENODEV;1771 return -ENODEV;
1766 1772
1773 /* Check if backend is trusted. */
1774 info->bounce = !xen_blkif_trusted ||
1775 !xenbus_read_unsigned(dev->nodename, "trusted", 1);
1776
1767 max_page_order = xenbus_read_unsigned(info->xbdev->otherend,1777 max_page_order = xenbus_read_unsigned(info->xbdev->otherend,
1768 "max-ring-page-order", 0);1778 "max-ring-page-order", 0);
1769 ring_page_order = min(xen_blkif_max_ring_order, max_page_order);1779 ring_page_order = min(xen_blkif_max_ring_order, max_page_order);
@@ -2173,17 +2183,18 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) · 403 unmodified lines
2173 if (err)2183 if (err)
2174 goto out_of_memory;2184 goto out_of_memory;
2175 2185
2176 if (!info->feature_persistent && info->max_indirect_segments) {2186 if (!info->bounce && info->max_indirect_segments) {
2177 /*2187 /*
2178 * We are using indirect descriptors but not persistent2188 * We are using indirect descriptors but don't have a bounce
2179 * grants, we need to allocate a set of pages that can be2189 * buffer, we need to allocate a set of pages that can be
2180 * used for mapping indirect grefs2190 * used for mapping indirect grefs
2181 */2191 */
2182 int num = INDIRECT_GREFS(grants) * BLK_RING_SIZE(info);2192 int num = INDIRECT_GREFS(grants) * BLK_RING_SIZE(info);
2183 2193
2184 BUG_ON(!list_empty(&rinfo->indirect_pages));2194 BUG_ON(!list_empty(&rinfo->indirect_pages));
2185 for (i = 0; i < num; i++) {2195 for (i = 0; i < num; i++) {
2186 struct page *indirect_page = alloc_page(GFP_KERNEL);2196 struct page *indirect_page = alloc_page(GFP_KERNEL |
2197 __GFP_ZERO);
2187 if (!indirect_page)2198 if (!indirect_page)
2188 goto out_of_memory;2199 goto out_of_memory;
2189 list_add(&indirect_page->lru, &rinfo->indirect_pages);2200 list_add(&indirect_page->lru, &rinfo->indirect_pages);
@@ -2276,6 +2287,8 @@ static void blkfront_gather_backend_features(struct blkfront_info *info) · 86 unmodified lines
2276 info->feature_persistent =2287 info->feature_persistent =
2277 !!xenbus_read_unsigned(info->xbdev->otherend,2288 !!xenbus_read_unsigned(info->xbdev->otherend,
2278 "feature-persistent", 0);2289 "feature-persistent", 0);
2290 if (info->feature_persistent)
2291 info->bounce = true;
2279 2292
2280 indirect_segments = xenbus_read_unsigned(info->xbdev->otherend,2293 indirect_segments = xenbus_read_unsigned(info->xbdev->otherend,
2281 "feature-max-indirect-segments", 0);2294 "feature-max-indirect-segments", 0);
@@ -2547,6 +2560,13 @@ static void blkfront_delay_work(struct work_struct *work) · 265 unmodified lines
2547 struct blkfront_info *info;2560 struct blkfront_info *info;
2548 bool need_schedule_work = false;2561 bool need_schedule_work = false;
2549 2562
2563 /*
2564 * Note that when using bounce buffers but not persistent grants
2565 * there's no need to run blkfront_delay_work because grants are
2566 * revoked in blkif_completion or else an error is reported and the
2567 * connection is closed.
2568 */
2569
2550 mutex_lock(&blkfront_mutex);2570 mutex_lock(&blkfront_mutex);
2551 2571
2552 list_for_each_entry(info, &info_list, info_list) {2572 list_for_each_entry(info, &info_list, info_list) {
drivers/net/xen-netfront.c+52−4
@@ -66,6 +66,10 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644); · 65 unmodified lines
66MODULE_PARM_DESC(max_queues,66MODULE_PARM_DESC(max_queues,
67 "Maximum number of queues per virtual interface");67 "Maximum number of queues per virtual interface");
68 68
69static bool __read_mostly xennet_trusted = true;
70module_param_named(trusted, xennet_trusted, bool, 0644);
71MODULE_PARM_DESC(trusted, "Is the backend trusted");
72
69#define XENNET_TIMEOUT (5 * HZ)73#define XENNET_TIMEOUT (5 * HZ)
70 74
71static const struct ethtool_ops xennet_ethtool_ops;75static const struct ethtool_ops xennet_ethtool_ops;
@@ -173,6 +177,9 @@ struct netfront_info { · 101 unmodified lines
173 /* Is device behaving sane? */177 /* Is device behaving sane? */
174 bool broken;178 bool broken;
175 179
180 /* Should skbs be bounced into a zeroed buffer? */
181 bool bounce;
182
176 atomic_t rx_gso_checksum_fixup;183 atomic_t rx_gso_checksum_fixup;
177};184};
178 185
@@ -271,7 +278,8 @@ static struct sk_buff *xennet_alloc_one_rx_buffer(struct netfront_queue *queue) · 92 unmodified lines
271 if (unlikely(!skb))278 if (unlikely(!skb))
272 return NULL;279 return NULL;
273 280
274 page = page_pool_dev_alloc_pages(queue->page_pool);281 page = page_pool_alloc_pages(queue->page_pool,
282 GFP_ATOMIC | __GFP_NOWARN | __GFP_ZERO);
275 if (unlikely(!page)) {283 if (unlikely(!page)) {
276 kfree_skb(skb);284 kfree_skb(skb);
277 return NULL;285 return NULL;
@@ -665,6 +673,33 @@ static int xennet_xdp_xmit(struct net_device *dev, int n, · 387 unmodified lines
665 return nxmit;673 return nxmit;
666}674}
667 675
676struct sk_buff *bounce_skb(const struct sk_buff *skb)
677{
678 unsigned int headerlen = skb_headroom(skb);
679 /* Align size to allocate full pages and avoid contiguous data leaks */
680 unsigned int size = ALIGN(skb_end_offset(skb) + skb->data_len,
681 XEN_PAGE_SIZE);
682 struct sk_buff *n = alloc_skb(size, GFP_ATOMIC | __GFP_ZERO);
683
684 if (!n)
685 return NULL;
686
687 if (!IS_ALIGNED((uintptr_t)n->head, XEN_PAGE_SIZE)) {
688 WARN_ONCE(1, "misaligned skb allocated\n");
689 kfree_skb(n);
690 return NULL;
691 }
692
693 /* Set the data pointer */
694 skb_reserve(n, headerlen);
695 /* Set the tail pointer and length */
696 skb_put(n, skb->len);
697
698 BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len));
699
700 skb_copy_header(n, skb);
701 return n;
702}
668 703
669#define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)704#define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)
670 705
@@ -718,9 +753,13 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev · 47 unmodified lines
718 753
719 /* The first req should be at least ETH_HLEN size or the packet will be754 /* The first req should be at least ETH_HLEN size or the packet will be
720 * dropped by netback.755 * dropped by netback.
756 *
757 * If the backend is not trusted bounce all data to zeroed pages to
758 * avoid exposing contiguous data on the granted page not belonging to
759 * the skb.
721 */760 */
722 if (unlikely(PAGE_SIZE - offset < ETH_HLEN)) {761 if (np->bounce || unlikely(PAGE_SIZE - offset < ETH_HLEN)) {
723 nskb = skb_copy(skb, GFP_ATOMIC);762 nskb = bounce_skb(skb);
724 if (!nskb)763 if (!nskb)
725 goto drop;764 goto drop;
726 dev_consume_skb_any(skb);765 dev_consume_skb_any(skb);
@@ -1053,8 +1092,10 @@ static int xennet_get_responses(struct netfront_queue *queue, · 326 unmodified lines
1053 }1092 }
1054 }1093 }
1055 rcu_read_unlock();1094 rcu_read_unlock();
1056next:1095
1057 __skb_queue_tail(list, skb);1096 __skb_queue_tail(list, skb);
1097
1098next:
1058 if (!(rx->flags & XEN_NETRXF_more_data))1099 if (!(rx->flags & XEN_NETRXF_more_data))
1059 break;1100 break;
1060 1101
@@ -2214,6 +2255,10 @@ static int talk_to_netback(struct xenbus_device *dev, · 1153 unmodified lines
2214 2255
2215 info->netdev->irq = 0;2256 info->netdev->irq = 0;
2216 2257
2258 /* Check if backend is trusted. */
2259 info->bounce = !xennet_trusted ||
2260 !xenbus_read_unsigned(dev->nodename, "trusted", 1);
2261
2217 /* Check if backend supports multiple queues */2262 /* Check if backend supports multiple queues */
2218 max_queues = xenbus_read_unsigned(info->xbdev->otherend,2263 max_queues = xenbus_read_unsigned(info->xbdev->otherend,
2219 "multi-queue-max-queues", 1);2264 "multi-queue-max-queues", 1);
@@ -2381,6 +2426,9 @@ static int xennet_connect(struct net_device *dev) · 161 unmodified lines
2381 return err;2426 return err;
2382 if (np->netback_has_xdp_headroom)2427 if (np->netback_has_xdp_headroom)
2383 pr_info("backend supports XDP headroom\n");2428 pr_info("backend supports XDP headroom\n");
2429 if (np->bounce)
2430 dev_info(&np->xbdev->dev,
2431 "bouncing transmitted data to zeroed pages\n");
2384 2432
2385 /* talk_to_netback() sets the correct number of queues */2433 /* talk_to_netback() sets the correct number of queues */
2386 num_queues = dev->real_num_tx_queues;2434 num_queues = dev->real_num_tx_queues;