tools/libs/light: fix BAR memory address truncation

64-bit BAR memory address is truncated when removing a passthrough
pci device from guest since it uses "unsigned int".

So, change to use 64-bit type to fix this problem.

This is XSA-476 / CVE-2025-58149.

Fixes: b0a1af6167 ("libxenlight: implement pci passthrough")
Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
This commit is contained in:
Jiqian Chen authored and Andrew Cooper committed 2025-10-24 13:21:35 +01:00
1 parent eff32008be
commit 421432b822
1 file changed
+6 -4
+6 -4
View File
@@ -2001,7 +2001,8 @@ static void pci_remove_detached(libxl__egc *egc,
{
STATE_AO_GC(prs->aodev->ao);
libxl_ctx *ctx = libxl__gc_owner(gc);
unsigned int start = 0, end = 0, flags = 0, size = 0, irq = 0;
uint64_t start = 0, end = 0, flags = 0, size = 0;
unsigned int irq = 0;
int i, stubdomid = 0;
const char *sysfs_path;
FILE *f;
@@ -2031,7 +2032,8 @@ static void pci_remove_detached(libxl__egc *egc,
}
for (i = 0; i < PROC_PCI_NUM_RESOURCES; i++) {
if (fscanf(f, "0x%x 0x%x 0x%x\n", &start, &end, &flags) != 3)
if (fscanf(f, "0x%"SCNx64" 0x%"SCNx64" 0x%"SCNx64"\n",
&start, &end, &flags) != 3)
continue;
size = end - start + 1;
if (start) {
@@ -2040,7 +2042,7 @@ static void pci_remove_detached(libxl__egc *egc,
size, 0);
if (rc < 0)
LOGED(ERROR, domid,
"xc_domain_ioport_permission error 0x%x/0x%x",
"xc_domain_ioport_permission error %#"PRIx64"/%#"PRIx64,
start,
size);
} else {
@@ -2050,7 +2052,7 @@ static void pci_remove_detached(libxl__egc *egc,
0);
if (rc < 0)
LOGED(ERROR, domid,
"xc_domain_iomem_permission error 0x%x/0x%x",
"xc_domain_iomem_permission error %#"PRIx64"/%#"PRIx64,
start,
size);
}
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.