Re: [Xen-devel] [PATCH 1/2] Xen/mem_event: Validate the response vcpu_id before acting on it.

[Andres Lagar Cavilla <andres@xxxxxxxxxxxxxxxx>]

On Thu, Jul 17, 2014 at 9:10 AM, Andrew Cooper <andrew.cooper3@xxxxxxxxxx> wrote:

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Tim Deegan <tim@xxxxxxx>
CC: Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx>

Reviewed-by: Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx>Â

---
Âxen/arch/x86/mm/mem_sharing.c | Â 11 ++++++++++-
Âxen/arch/x86/mm/p2m.c     |  22 ++++++++++++++++++++--
Â2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/mm/mem_sharing.c b/xen/arch/x86/mm/mem_sharing.c
index 7293f31..ec99266 100644
--- a/xen/arch/x86/mm/mem_sharing.c
+++ b/xen/arch/x86/mm/mem_sharing.c
@@ -596,11 +596,20 @@ int mem_sharing_sharing_resume(struct domain *d)
  Â/* Get all requests off the ring */
  Âwhile ( mem_event_get_response(d, &d->mem_event->share, &rsp) )
  Â{
+ Â Â Â Âstruct vcpu *v;
+
    Âif ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
      Âcontinue;
+
+ Â Â Â Â/* Validate the vcpu_id in the response. */
+ Â Â Â Âif ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
+ Â Â Â Â Â Âcontinue;
+
+ Â Â Â Âv = d->vcpu[rsp.vcpu_id];
+
    Â/* Unpause domain/vcpu */
    Âif ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
- Â Â Â Â Â Âvcpu_unpause(d->vcpu[rsp.vcpu_id]);
+ Â Â Â Â Â Âvcpu_unpause(v);
  Â}

  Âreturn 0;
diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
index 642ec28..f213a39 100644
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -1290,8 +1290,17 @@ void p2m_mem_paging_resume(struct domain *d)
  Â/* Pull all responses off the ring */
  Âwhile( mem_event_get_response(d, &d->mem_event->paging, &rsp) )
  Â{
+ Â Â Â Âstruct vcpu *v;
+
    Âif ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
      Âcontinue;
+
+ Â Â Â Â/* Validate the vcpu_id in the response. */
+ Â Â Â Âif ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
+ Â Â Â Â Â Âcontinue;
+
+ Â Â Â Âv = d->vcpu[rsp.vcpu_id];
+
    Â/* Fix p2m entry if the page was not dropped */
    Âif ( !(rsp.flags & MEM_EVENT_FLAG_DROP_PAGE) )
    Â{
@@ -1310,7 +1319,7 @@ void p2m_mem_paging_resume(struct domain *d)
    Â}
    Â/* Unpause domain */
    Âif ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
- Â Â Â Â Â Âvcpu_unpause(d->vcpu[rsp.vcpu_id]);
+ Â Â Â Â Â Âvcpu_unpause(v);
  Â}
Â}

@@ -1418,11 +1427,20 @@ void p2m_mem_access_resume(struct domain *d)
  Â/* Pull all responses off the ring */
  Âwhile( mem_event_get_response(d, &d->mem_event->access, &rsp) )
  Â{
+ Â Â Â Âstruct vcpu *v;
+
    Âif ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
      Âcontinue;
+
+ Â Â Â Â/* Validate the vcpu_id in the response. */
+ Â Â Â Âif ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
+ Â Â Â Â Â Âcontinue;
+
+ Â Â Â Âv = d->vcpu[rsp.vcpu_id];
+
    Â/* Unpause domain */
    Âif ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
- Â Â Â Â Â Âvcpu_unpause(d->vcpu[rsp.vcpu_id]);
+ Â Â Â Â Â Âvcpu_unpause(v);
  Â}
Â}

--
1.7.10.4

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel