[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH 2/4] x86: add address validity check to guest_map_l1e()
Just like for guest_get_eff_l1e() this prevents accessing as page tables (and with the wrong memory attribute) internal data inside Xen happening to be mapped with 1Gb pages. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> --- a/xen/include/asm-x86/paging.h +++ b/xen/include/asm-x86/paging.h @@ -360,7 +360,8 @@ guest_map_l1e(struct vcpu *v, unsigned l return paging_get_hostmode(v)->guest_map_l1e(v, addr, gl1mfn); /* Find this l1e and its enclosing l1mfn in the linear map */ - if ( __copy_from_user(&l2e, + if ( !__addr_ok(addr) || + __copy_from_user(&l2e, &__linear_l2_table[l2_linear_offset(addr)], sizeof(l2_pgentry_t)) != 0 ) return NULL; Attachment:
x86-guest_map_l1e-check.patch _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |