diff options
| author | Ian Campbell <ian.campbell@citrix.com> | 2012-09-25 12:24:37 +0200 |
|---|---|---|
| committer | Ian Campbell <ian.campbell@citrix.com> | 2012-09-25 12:24:37 +0200 |
| commit | afdc11f69ab71efa24145f9e747964066bcecefd (patch) | |
| tree | e18b91ff9f056083e3d554079e0d9f7fd854341f | |
| parent | 16bae237b197bc925a60c5c783004e609e9b43c1 (diff) | |
| download | xen-afdc11f69ab71efa24145f9e747964066bcecefd.tar.gz xen-afdc11f69ab71efa24145f9e747964066bcecefd.tar.bz2 xen-afdc11f69ab71efa24145f9e747964066bcecefd.zip | |
tmem: consistently make pool_id a uint32_t
Treating it as an int could allow a malicious guest to provide a
negative pool_Id, by passing the MAX_POOLS_PER_DOMAIN limit check and
allowing access to the negative offsets of the pool array.
This is part of XSA-15 / CVE-2012-3497.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
xen-unstable changeset: 25851:fcf567acc92a
xen-unstable date: Tue Sep 11 12:06:43 UTC 2012
| -rw-r--r-- | xen/common/tmem.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 06c9e0eaed..63a9ed05e3 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -2420,7 +2420,7 @@ static NOINLINE int tmemc_save_subop(int cli_id, uint32_t pool_id, return rc; } -static NOINLINE int tmemc_save_get_next_page(int cli_id, int pool_id, +static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id, tmem_cli_va_t buf, uint32_t bufsize) { client_t *client = tmh_client_from_cli_id(cli_id); @@ -2512,7 +2512,7 @@ out: return ret; } -static int tmemc_restore_put_page(int cli_id, int pool_id, OID *oidp, +static int tmemc_restore_put_page(int cli_id, uint32_t pool_id, OID *oidp, uint32_t index, tmem_cli_va_t buf, uint32_t bufsize) { client_t *client = tmh_client_from_cli_id(cli_id); @@ -2524,7 +2524,7 @@ static int tmemc_restore_put_page(int cli_id, int pool_id, OID *oidp, return do_tmem_put(pool,oidp,index,0,0,0,bufsize,buf.p); } -static int tmemc_restore_flush_page(int cli_id, int pool_id, OID *oidp, +static int tmemc_restore_flush_page(int cli_id, uint32_t pool_id, OID *oidp, uint32_t index) { client_t *client = tmh_client_from_cli_id(cli_id); |