Re: i386/xen: prevent guest from binding loopback event channel to itself

[Bernhard Beschow <shentey@gmail.com>]

Am 26. Juli 2023 09:24:28 UTC schrieb Paul Durrant <xadimgnik@gmail.com>:
>On 26/07/2023 10:07, David Woodhouse wrote:
>> On Wed, 2023-07-26 at 09:44 +0100, Paul Durrant wrote:
>>> On 25/07/2023 11:05, David Woodhouse wrote:
>>>> From: David Woodhouse <dwmw@amazon.co.uk>
>>>> 
>>>> Fuzzing showed that a guest could bind an interdomain port to itself, by
>>>> guessing the next port to be allocated and putting that as the 'remote'
>>>> port number. By chance, that works because the newly-allocated port has
>>>> type EVTCHNSTAT_unbound. It shouldn't.
>>>> 
>>>> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
>>>> ---
>>>>    hw/i386/kvm/xen_evtchn.c | 11 +++++++++--
>>>>    1 file changed, 9 insertions(+), 2 deletions(-)
>>>> 
>>> 
>>> Reviewed-by: Paul Durrant <paul@xen.org>
>>> 
>> 
>> Thanks. I'll change the title prefix to 'hw/xen' since it's in hw/ not
>> target/i386.
>
>Yes, makes sense.
>
>> Please can I have also have a review for
>> https://lore.kernel.org/qemu-devel/20076888f6bdf06a65aafc5cf954260965d45b97.camel@infradead.org/
>> 
>
>Sorry I missed that. Done.

And that one, too please? https://lore.kernel.org/qemu-devel/20230720072950.20198-1-olaf@aepfle.de/

Sorry for cross posting, but the patch would be good to have in 8.1.

Best regards,
Bernhard

>
>Cheers,
>
>  Paul
>