diff options
author | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-01-07 15:02:05 -0200 |
---|---|---|
committer | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-01-07 15:02:05 -0200 |
commit | c3173338df6eecc9dc6bf780cbfe7ab57e5d46b7 (patch) | |
tree | 6e1976eadea766349a14d195fbd7aceca2a364ac /kernels/xen/xsa78.patch | |
parent | 8ed713ab896f4eff72c669c4d27986b6d99d2004 (diff) | |
download | abslibre-c3173338df6eecc9dc6bf780cbfe7ab57e5d46b7.tar.gz abslibre-c3173338df6eecc9dc6bf780cbfe7ab57e5d46b7.tar.bz2 abslibre-c3173338df6eecc9dc6bf780cbfe7ab57e5d46b7.zip |
xen-4.3.1-2: updating version
Diffstat (limited to 'kernels/xen/xsa78.patch')
-rw-r--r-- | kernels/xen/xsa78.patch | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/kernels/xen/xsa78.patch b/kernels/xen/xsa78.patch new file mode 100644 index 000000000..180506cdd --- /dev/null +++ b/kernels/xen/xsa78.patch @@ -0,0 +1,23 @@ +VT-d: fix TLB flushing in dma_pte_clear_one() + +The third parameter of __intel_iommu_iotlb_flush() is to indicate +whether the to be flushed entry was a present one. A few lines before, +we bailed if !dma_pte_present(*pte), so there's no need to check the +flag here again - we can simply always pass TRUE here. + +This is CVE-2013-6375 / XSA-78. + +Suggested-by: Cheng Yueqiang <yqcheng.2008@phdis.smu.edu.sg> +Signed-off-by: Jan Beulich <jbeulich@suse.com> + +--- a/xen/drivers/passthrough/vtd/iommu.c ++++ b/xen/drivers/passthrough/vtd/iommu.c +@@ -646,7 +646,7 @@ static void dma_pte_clear_one(struct dom + iommu_flush_cache_entry(pte, sizeof(struct dma_pte)); + + if ( !this_cpu(iommu_dont_flush_iotlb) ) +- __intel_iommu_iotlb_flush(domain, addr >> PAGE_SHIFT_4K , 0, 1); ++ __intel_iommu_iotlb_flush(domain, addr >> PAGE_SHIFT_4K, 1, 1); + + unmap_vtd_domain_page(page); + |