OrgACRN
/
acrn-hypervisor
mirror of https://github.com/projectacrn/acrn-hypervisor.git
1
0
Fork 0
Code Issues Releases Wiki Activity

hv: fix vulnerability when VM is destroyed 

In hypervisor fuzzing test, hypervisor will hang
 if issuing HV_VM_SET_MEMORY_REGIONS hypercall after
 target VM is destroyed.

 this patch is to fix above vulnerability.

Tracked-On: #2849
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Anthony Xu <anthony.xu@intel.com>
This commit is contained in:
Yonghua Huang 2019-03-26 01:37:46 +08:00 committed by ACRN System Integration
parent 5a7be9b869
commit 868778a68b
3 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hypervisor/arch/x86/guest/vm.c
View File

@ -448,6 +448,8 @@ int32_t shutdown_vm(struct acrn_vm *vm)
/* Only allow shutdown paused vm */
if (vm->state == VM_PAUSED) {
vm->state = VM_STATE_INVALID;
foreach_vcpu(i, vm, vcpu) {
reset_vcpu(vcpu);
offline_vcpu(vcpu);

13
hypervisor/common/hypercall.c
View File

@ -665,20 +665,19 @@ int32_t hcall_set_vm_memory_regions(struct acrn_vm *vm, uint64_t param)
struct set_regions regions;
struct vm_memory_region mr;
struct acrn_vm *target_vm;
uint16_t target_vm_id;
uint32_t idx;
int32_t ret = 0;
int32_t ret = -EFAULT;
(void)memset((void *)&regions, 0U, sizeof(regions));
if (copy_from_gpa(vm, &regions, param, sizeof(regions)) != 0) {
pr_err("%s: Unable copy param from vm\n", __func__);
ret = -EFAULT;
} else {
if (copy_from_gpa(vm, &regions, param, sizeof(regions)) == 0) {
target_vm = get_vm_from_vmid(regions.vmid);
if ((target_vm == NULL) || is_sos_vm(target_vm)) {
target_vm_id = target_vm->vm_id;
if ((target_vm_id >= CONFIG_MAX_VM_NUM) || (get_vm_config(target_vm_id)->type != NORMAL_VM)
|| (target_vm->state == VM_STATE_INVALID)) {
pr_err("%p %s:target_vm is invalid or Targeting to service vm", target_vm, __func__);
ret = -EFAULT;
} else {
idx = 0U;
while (idx < regions.mr_num) {

2
hypervisor/include/arch/x86/guest/vm.h
View File

@ -85,7 +85,7 @@ struct vm_pm_info {
#define VM_MONO_GUEST 0x01
/* Enumerated type for VM states */
enum vm_state {
VM_STATE_UNKNOWN = 0,
VM_STATE_INVALID = 0,
VM_CREATED, /* VM created / awaiting start (boot) */
VM_STARTED, /* VM started (booted) */
VM_PAUSED, /* VM paused */