[Xen-devel] [PATCH] x86, shadow: confirm the validity of mfn before is_xen_heap_mfn()

[Kouya Shimura <kouya@xxxxxxxxxxxxxx>]

xen hypervisor may crash with direct access to MMIO on hvm.

Signed-off-by: Kouya Shimura <kouya@xxxxxxxxxxxxxx>

diff -r 191643d4307c xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c    Thu Feb 05 15:28:09 2009 +0000
+++ b/xen/arch/x86/mm/shadow/multi.c    Fri Feb 06 16:49:09 2009 +0900
@@ -543,7 +543,7 @@
      * caching attributes in the shadows to match what was asked for.
      */
     if ( (level == 1) && is_hvm_domain(d) && has_arch_pdevs(d) &&
-         !is_xen_heap_mfn(mfn_x(target_mfn)) )
+         !(mfn_valid(target_mfn) && is_xen_heap_mfn(mfn_x(target_mfn))) )
     {
         unsigned int type;
         if ( hvm_get_mem_pinned_cacheattr(d, gfn_x(target_gfn), &type) )

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel