Re: [PATCH] xen/arm: validate max grant frames against the grant table region

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Mon, 19 Oct 2026, Michal Orzel wrote:
> Per the binding (docs/misc/arm/device-tree/guest.txt), region 0 for
> mapping grant table is large enough to map the whole grant table. Xen
> never checks that this holds:
>  - enhanced dom0less domUs are given GUEST_GNTTAB_SIZE (4096 frames),
>    while their limit comes from the max_grant_frames DT property or, if
>    absent, from the gnttab_max_frames command line option or default,
>    neither of which is bounded by the region size,
>  - a dom0less hardware domain is given gnttab_dom0_frames() frames,
>    while the max_grant_frames DT property can raise its limit above
>    that.
> 
> A guest growing its grant table past the end of the region ends up
> mapping grant frames over whatever follows it in its address space,
> e.g. the magic pages at GUEST_MAGIC_BASE for a domU.
> 
> Validate that the configured max frames can actually fit in the region
> Xen exposes in make_hypervisor_node().
> 
> Fix find_gnttab_region() logic of setting the gnttab_size for hardware
> domain to allow the max frames up until the size of the text section.
> Otherwise, the DT setting would only allow to shrink it from the
> default.
> 
> Fixes: 79eb2871f25e ("xen/arm: configure dom0less domain for enabling 
> xenstore after boot")
> Fixes: df68a4cb7ed9 ("xen/arm: Add capabilities to dom0less")
> Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>

Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>