From 4d1549ec621b69741177b3386648b99c8d643ca1 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 20 Aug 2013 15:38:24 +0200 Subject: VT-d: protect against bogus information coming from BIOS Add checks similar to those done by Linux: The DRHD address must not be all zeros or all ones (Linux only checks for zero), and capabilities as well as extended capabilities must not be all ones. Signed-off-by: Jan Beulich Reviewed-by: Ben Guthro Reviewed-by: Andrew Cooper Tested-by: Ben Guthro Acked by: Yang Zhang Acked-by: Xiantao Zhang master commit: e8e8b030ecf916fea19639f0b6a446c1c9dbe174 master date: 2013-08-14 11:18:24 +0200 --- xen/drivers/passthrough/vtd/dmar.c | 3 +++ xen/drivers/passthrough/vtd/iommu.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 464c14a38f..309a985447 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -405,6 +405,9 @@ acpi_parse_one_drhd(struct acpi_dmar_header *header) if ( (ret = acpi_dmar_check_length(header, sizeof(*drhd))) != 0 ) return ret; + if ( !drhd->address || !(drhd->address + 1) ) + return -ENODEV; + dmaru = xzalloc(struct acpi_drhd_unit); if ( !dmaru ) return -ENOMEM; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 071a91b0ac..8c24c04584 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1198,6 +1198,9 @@ int __init iommu_alloc(struct acpi_drhd_unit *drhd) dprintk(VTDPREFIX, "cap = %"PRIx64" ecap = %"PRIx64"\n", iommu->cap, iommu->ecap); } + if ( !(iommu->cap + 1) || !(iommu->ecap + 1) ) + return -ENODEV; + if ( cap_fault_reg_offset(iommu->cap) + cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_REG_LEN >= PAGE_SIZE || ecap_iotlb_offset(iommu->ecap) >= PAGE_SIZE ) -- cgit v1.2.3