Skip to contentSkip to conversation

xen: detect uninitialized xenbus in xenbus_init

PATCH Applied Stefano Stabellini 4 participants 4 messages Nov 23, 2021 – Nov 25, 2021

Subsystems (2)
Stable branch Xen hypervisor interface
lore
Share & tools
lore

Stefano Stabellini

author maintainer
#0 lore raw

PATCH v4 1/1 xen: detect uninitialized xenbus in xenbus_init

From: Stefano Stabellini <[email protected]>

If the xenstore page hasn't been allocated properly, reading the value of the related hvm_param (HVM_PARAM_STORE_PFN) won't actually return error. Instead, it will succeed and return zero. Instead of attempting to xen_remap a bad guest physical address, detect this condition and return early.

Note that although a guest physical address of zero for HVM_PARAM_STORE_PFN is theoretically possible, it is not a good choice and zero has never been validly used in that capacity.

Also recognize all bits set as an invalid value.

For 32-bit Linux, any pfn above ULONG_MAX would get truncated. Pfns above ULONG_MAX should never be passed by the Xen tools to HVM guests anyway, so check for this condition and return early.

Cc [email protected]
Signed-off-by Stefano Stabellini <[email protected]>

---
Changes in v4:
- say "all bits set" instead of INVALID_PFN
- improve check

Changes in v3:
- improve in-code comment
- improve check

Changes in v2:
- add check for ULLONG_MAX (unitialized)
- add check for ULONG_MAX #if BITS_PER_LONG == 32 (actual error)
- add pr_err error message

 drivers/xen/xenbus/xenbus_probe.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
drivers/xen/xenbus/xenbus_probe.c +23 -0
index 94405bb3829e..251b26439733 100644
@@ -951,6 +951,29 @@ static int __init xenbus_init(void)
 		err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v);
 		if (err)
 			goto out_error;
+		/*
+		 * Uninitialized hvm_params are zero and return no error.
+		 * Although it is theoretically possible to have
+		 * HVM_PARAM_STORE_PFN set to zero on purpose, in reality it is
+		 * not zero when valid. If zero, it means that Xenstore hasn't
+		 * been properly initialized. Instead of attempting to map a
+		 * wrong guest physical address return error.
+		 *
+		 * Also recognize all bits set as an invalid value.
+		 */
+		if (!v || !~v) {
+			err = -ENOENT;
+			goto out_error;
+		}
+		/* Avoid truncation on 32-bit. */
+#if BITS_PER_LONG == 32
+		if (v > ULONG_MAX) {
+			pr_err("%s: cannot handle HVM_PARAM_STORE_PFN=%llx > ULONG_MAX\n",
+			       __func__, v);
+			err = -EINVAL;
+			goto out_error;
+		}
+#endif
 		xen_store_gfn = (unsigned long)v;
 		xen_store_interface =
 			xen_remap(xen_store_gfn << XEN_PAGE_SHIFT,
Signature · 1 line
2.25.1
maintainer Reviewed-by on v4 1/1
#1 lore raw
Quoted 12 lines · Stefano Stabellini

From: Stefano Stabellini <[email protected]>

If the xenstore page hasn't been allocated properly, reading the value of the related hvm_param (HVM_PARAM_STORE_PFN) won't actually return error. Instead, it will succeed and return zero. Instead of attempting to xen_remap a bad guest physical address, detect this condition and return early.

Note that although a guest physical address of zero for HVM_PARAM_STORE_PFN is theoretically possible, it is not a good choice and zero has never been validly used in that capacity.

Quoted 8 lines

Also recognize all bits set as an invalid value.

For 32-bit Linux, any pfn above ULONG_MAX would get truncated. Pfns above ULONG_MAX should never be passed by the Xen tools to HVM guests anyway, so check for this condition and return early.

Cc [email protected]
Signed-off-by Stefano Stabellini <[email protected]>
Reviewed-by Juergen Gross <[email protected]>

Juergen

Reviewed-by on v4 1/1
#2 lore raw
In reply to Stefano Stabellini
Quoted 12 lines · Stefano Stabellini

From: Stefano Stabellini <[email protected]>

If the xenstore page hasn't been allocated properly, reading the value of the related hvm_param (HVM_PARAM_STORE_PFN) won't actually return error. Instead, it will succeed and return zero. Instead of attempting to xen_remap a bad guest physical address, detect this condition and return early.

Note that although a guest physical address of zero for HVM_PARAM_STORE_PFN is theoretically possible, it is not a good choice and zero has never been validly used in that capacity.

Quoted 8 lines

Also recognize all bits set as an invalid value.

For 32-bit Linux, any pfn above ULONG_MAX would get truncated. Pfns above ULONG_MAX should never be passed by the Xen tools to HVM guests anyway, so check for this condition and return early.

Cc [email protected]
Signed-off-by Stefano Stabellini <[email protected]>
Reviewed-by Jan Beulich <[email protected]>
Applied
#3 lore raw
In reply to Stefano Stabellini
Quoted 12 lines · Stefano Stabellini

From: Stefano Stabellini <[email protected]>

If the xenstore page hasn't been allocated properly, reading the value of the related hvm_param (HVM_PARAM_STORE_PFN) won't actually return error. Instead, it will succeed and return zero. Instead of attempting to xen_remap a bad guest physical address, detect this condition and return early.

Note that although a guest physical address of zero for HVM_PARAM_STORE_PFN is theoretically possible, it is not a good choice and zero has never been validly used in that capacity.

Quoted 8 lines

Also recognize all bits set as an invalid value.

For 32-bit Linux, any pfn above ULONG_MAX would get truncated. Pfns above ULONG_MAX should never be passed by the Xen tools to HVM guests anyway, so check for this condition and return early.

Cc [email protected]
Signed-off-by Stefano Stabellini <[email protected]>

Applied to for-linus-5.16c

-boris