Skip to content

Commit 832ecbf

Browse files
Jiqian Chenandyhhp
authored andcommitted
tools/libs/light: fix BAR memory address truncation
64-bit BAR memory address is truncated when removing a passthrough pci device from guest since it uses "unsigned int". So, change to use 64-bit type to fix this problem. This is XSA-476 / CVE-2025-58149. Fixes: b0a1af6 ("libxenlight: implement pci passthrough") Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com> Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@vates.tech> (cherry picked from commit 421432b)
1 parent 9143406 commit 832ecbf

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

tools/libs/light/libxl_pci.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2168,7 +2168,7 @@ static void pci_remove_detached(libxl__egc *egc,
21682168
{
21692169
STATE_AO_GC(prs->aodev->ao);
21702170
libxl_ctx *ctx = libxl__gc_owner(gc);
2171-
unsigned int start = 0, end = 0, flags = 0, size = 0;
2171+
uint64_t start = 0, end = 0, flags = 0, size = 0;
21722172
int irq = 0, i, stubdomid = 0;
21732173
const char *sysfs_path;
21742174
FILE *f;
@@ -2198,7 +2198,8 @@ static void pci_remove_detached(libxl__egc *egc,
21982198
}
21992199

22002200
for (i = 0; i < PROC_PCI_NUM_RESOURCES; i++) {
2201-
if (fscanf(f, "0x%x 0x%x 0x%x\n", &start, &end, &flags) != 3)
2201+
if (fscanf(f, "0x%"SCNx64" 0x%"SCNx64" 0x%"SCNx64"\n",
2202+
&start, &end, &flags) != 3)
22022203
continue;
22032204
size = end - start + 1;
22042205
if (start) {
@@ -2207,7 +2208,7 @@ static void pci_remove_detached(libxl__egc *egc,
22072208
size, 0);
22082209
if (rc < 0)
22092210
LOGED(ERROR, domid,
2210-
"xc_domain_ioport_permission error 0x%x/0x%x",
2211+
"xc_domain_ioport_permission error %#"PRIx64"/%#"PRIx64,
22112212
start,
22122213
size);
22132214
} else {
@@ -2217,7 +2218,7 @@ static void pci_remove_detached(libxl__egc *egc,
22172218
0);
22182219
if (rc < 0)
22192220
LOGED(ERROR, domid,
2220-
"xc_domain_iomem_permission error 0x%x/0x%x",
2221+
"xc_domain_iomem_permission error %#"PRIx64"/%#"PRIx64,
22212222
start,
22222223
size);
22232224
}

0 commit comments

Comments
 (0)