1 files changed, 76 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa262-4.10.patch b/system/xen/xsa/xsa262-4.10.patch
new file mode 100644
index 0000000000000..ba9a8ffa22f7d
--- /dev/null
+++ b/system/xen/xsa/xsa262-4.10.patch
@@ -0,0 +1,76 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: x86/HVM: guard against emulator driving ioreq state in weird ways
+
+In the case where hvm_wait_for_io() calls wait_on_xen_event_channel(),
+p->state ends up being read twice in succession: once to determine that
+state != p->state, and then again at the top of the loop.  This gives a
+compromised emulator a chance to change the state back between the two
+reads, potentially keeping Xen in a loop indefinitely.
+
+Instead:
+* Read p->state once in each of the wait_on_xen_event_channel() tests,
+* re-use that value the next time around,
+* and insist that the states continue to transition "forward" (with the
+  exception of the transition to STATE_IOREQ_NONE).
+
+This is XSA-262.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: George Dunlap <george.dunlap@citrix.com>
+
+--- a/xen/arch/x86/hvm/ioreq.c
++++ b/xen/arch/x86/hvm/ioreq.c
+@@ -87,14 +87,17 @@ static void hvm_io_assist(struct hvm_ior
+ 
+ static bool hvm_wait_for_io(struct hvm_ioreq_vcpu *sv, ioreq_t *p)
+ {
++    unsigned int prev_state = STATE_IOREQ_NONE;
++
+     while ( sv->pending )
+     {
+         unsigned int state = p->state;
+ 
+-        rmb();
+-        switch ( state )
++        smp_rmb();
++
++    recheck:
++        if ( unlikely(state == STATE_IOREQ_NONE) )
+         {
+-        case STATE_IOREQ_NONE:
+             /*
+              * The only reason we should see this case is when an
+              * emulator is dying and it races with an I/O being
+@@ -102,14 +105,30 @@ static bool hvm_wait_for_io(struct hvm_i
+              */
+             hvm_io_assist(sv, ~0ul);
+             break;
++        }
++
++        if ( unlikely(state < prev_state) )
++        {
++            gdprintk(XENLOG_ERR, "Weird HVM ioreq state transition %u -> %u\n",
++                     prev_state, state);
++            sv->pending = false;
++            domain_crash(sv->vcpu->domain);
++            return false; /* bail */
++        }
++
++        switch ( prev_state = state )
++        {
+         case STATE_IORESP_READY: /* IORESP_READY -> NONE */
+             p->state = STATE_IOREQ_NONE;
+             hvm_io_assist(sv, p->data);
+             break;
+         case STATE_IOREQ_READY:  /* IOREQ_{READY,INPROCESS} -> IORESP_READY */
+         case STATE_IOREQ_INPROCESS:
+-            wait_on_xen_event_channel(sv->ioreq_evtchn, p->state != state);
+-            break;
++            wait_on_xen_event_channel(sv->ioreq_evtchn,
++                                      ({ state = p->state;
++                                         smp_rmb();
++                                         state != prev_state; }));
++            goto recheck;
+         default:
+             gdprintk(XENLOG_ERR, "Weird HVM iorequest state %u\n", state);
+             sv->pending = false;