[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one()
- To: Oleksandr Tyshchenko <Oleksandr_Tyshchenko@xxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: "Orzel, Michal" <michal.orzel@xxxxxxx>
- Date: Fri, 17 Jul 2026 09:23:11 +0200
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=epam.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UG2sZasIwCGKu2i/dou0Rx3A1ZXNa/zg9x2+F//njLE=; b=aaOTM6ez9KmfpTWyzuyFNU36gOzA9ip+aJGb/iFsTpiC9vhs0+w+7ywsdsWyR6B8lcHO6r4p+LB1HOhMgKL82yugB2IXtMdSWFsLDRQz6pk3Xh3X4L/bVK7EwaMLoRa2MzWtDtrRsriV1zZsBugeU9JPq8oyahDvpF0fgJyw7GpeHEQTcsoPb4ZzRvo+eUAo4TmUD6SkK2Gs2DF1QSUTxh2I5rErk9DzOEVKBD8oWKsPP2qPyZo/Y7fBvbqjY0v6FZGr5yeEz9VjQSeSqX8q5K/ECa6PpkDq1NZtX8BnhNE4mk8qqKyUGbEvcsVa/6CN5yJhxDwERXUdQz+EmcAnQQ==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ittTBPQQeiZzGb4Wa0alj1gzJs+MWiU90hFp3ijpwA5RS1YtkSkeSSmh2VHEEP5fUYd/2ouI+SmALj24VSExBuJu1a2pvhuGqtclyyGHUPn4Bly/HXy/z06nUZitXnq0jP8rEeQ/BF/imd8gs6Ml5NEiQPoZ3Xa7JvCjAVR3U1jZZPGIe5PpGSR1qFy4Jlyz4qGV5qfWpFc6dWATEToLl5E5Q6fE4JiMPHhBRbS+0gaBnK+sZu3WjioZSvXwV3jB2Gp219jLK9zNQCHdrw3XB99ObL2UPbRHeu7iEdBioCjxsIYFAlMwiAvJJ6iQdT0FXKxQAcHEnUE1TYJeoIk5ww==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, "Volodymyr Babchuk" <Volodymyr_Babchuk@xxxxxxxx>, Ayan Kumar Halder <ayankuma@xxxxxxx>, Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
- Delivery-date: Fri, 17 Jul 2026 07:23:27 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 14-Jul-26 21:16, Oleksandr Tyshchenko wrote:
> A privileged domain on Arm64 can trigger a data abort in the hypervisor
> by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with
> space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO.
>
> get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io
> pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then
> attempts to walk dom_io's P2M table, which is not initialized for
> pseudo-domains, resulting in a data abort in p2m_get_entry() when
> it dereferences the invalid pointer returned by p2m_get_root_pointer().
>
> Replace get_pg_owner() with explicit domain lookup logic matching
> the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen),
> and resolve all other domain IDs via rcu_lock_remote_domain_by_id(),
> which rejects pseudo-domains (DOMID_IO, etc.) that are not present in
> the domain hash, returning -ESRCH before any P2M access occurs.
>
> Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page
> from DOMID_XEN")
> Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>
I would be ok to take this patch in for 4.22. Oleksii, other maintainers?
~Michal
|
