Re: [PATCH] xen/arm: Reject pseudo-domain foreign mappings in xenmem_add_to_physmap_one()
"Orzel, Michal" <[email protected]>
| Newsgroups | org.xenproject.lists.xen-devel |
|---|---|
| Message-ID | <[email protected]> |
On 14-Jul-26 21:16, Oleksandr Tyshchenko wrote:
> A privileged domain on Arm64 can trigger a data abort in the hypervisor
> by issuing memory_op's XENMEM_add_to_physmap_batch sub-op with
> space=XENMAPSPACE_gmfn_foreign, idx=0 and foreign_domid=DOMID_IO.
>
> get_pg_owner(DOMID_IO) succeeds, returning a pointer to the dom_io
> pseudo-domain. The subsequent get_page_from_gfn(dom_io, ...) then
> attempts to walk dom_io's P2M table, which is not initialized for
> pseudo-domains, resulting in a data abort in p2m_get_entry() when
> it dereferences the invalid pointer returned by p2m_get_root_pointer().
>
> Replace get_pg_owner() with explicit domain lookup logic matching
> the x86 implementation: handle DOMID_XEN via rcu_lock_domain(dom_xen),
> and resolve all other domain IDs via rcu_lock_remote_domain_by_id(),
> which rejects pseudo-domains (DOMID_IO, etc.) that are not present in
> the domain hash, returning -ESRCH before any P2M access occurs.
>
> Fixes: 615897bc6c01 ("xen/arm: Allow a privileged domain to map foreign page from DOMID_XEN")
> Signed-off-by: Oleksandr Tyshchenko <[email protected]>
Reviewed-by: Michal Orzel <[email protected]>
I would be ok to take this patch in for 4.22. Oleksii, other maintainers?
~Michal