1 files changed, 65 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa197-qemut.patch b/system/xen/xsa/xsa197-qemut.patch
new file mode 100644
index 0000000000..878f7d3566
--- /dev/null
+++ b/system/xen/xsa/xsa197-qemut.patch
@@ -0,0 +1,65 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: xen: fix ioreq handling
+
+Avoid double fetches and bounds check size to avoid overflowing
+internal variables.
+
+This is XSA-197.
+
+Reported-by: yanghongke <yanghongke@huawei.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
+
+--- a/i386-dm/helper2.c
++++ b/i386-dm/helper2.c
+@@ -375,6 +375,11 @@ static void cpu_ioreq_pio(CPUState *env,
+ {
+     uint32_t i;
+ 
++    if (req->size > sizeof(unsigned long)) {
++        fprintf(stderr, "PIO: bad size (%u)\n", req->size);
++        exit(-1);
++    }
++
+     if (req->dir == IOREQ_READ) {
+         if (!req->data_is_ptr) {
+             req->data = do_inp(env, req->addr, req->size);
+@@ -404,6 +409,11 @@ static void cpu_ioreq_move(CPUState *env
+ {
+     uint32_t i;
+ 
++    if (req->size > sizeof(req->data)) {
++        fprintf(stderr, "MMIO: bad size (%u)\n", req->size);
++        exit(-1);
++    }
++
+     if (!req->data_is_ptr) {
+         if (req->dir == IOREQ_READ) {
+             for (i = 0; i < req->count; i++) {
+@@ -516,11 +526,13 @@ static int __handle_buffered_iopage(CPUS
+         req.df = 1;
+         req.type = buf_req->type;
+         req.data_is_ptr = 0;
++        xen_rmb();
+         qw = (req.size == 8);
+         if (qw) {
+             buf_req = &buffered_io_page->buf_ioreq[(rdptr + 1) %
+                                                    IOREQ_BUFFER_SLOT_NUM];
+             req.data |= ((uint64_t)buf_req->data) << 32;
++            xen_rmb();
+         }
+ 
+         __handle_ioreq(env, &req);
+@@ -552,7 +564,11 @@ static void cpu_handle_ioreq(void *opaqu
+ 
+     __handle_buffered_iopage(env);
+     if (req) {
+-        __handle_ioreq(env, req);
++        ioreq_t copy = *req;
++
++        xen_rmb();
++        __handle_ioreq(env, &copy);
++        req->data = copy.data;
+ 
+         if (req->state != STATE_IOREQ_INPROCESS) {
+             fprintf(logfile, "Badness in I/O request ... not in service?!: "