diff options
| author | Ian Jackson <Ian.Jackson@eu.citrix.com> | 2012-09-05 12:29:05 +0100 |
|---|---|---|
| committer | Ian Jackson <Ian.Jackson@eu.citrix.com> | 2012-09-05 12:29:05 +0100 |
| commit | fec1c620d9903766b01f802e871cc1eecb039b5f (patch) | |
| tree | 65312ccf96ee5180ef090ae6ec4a324754ecc17d | |
| parent | f2913de21711c3ba6bf2780564e25190bf3c97a8 (diff) | |
| download | xen-fec1c620d9903766b01f802e871cc1eecb039b5f.tar.gz xen-fec1c620d9903766b01f802e871cc1eecb039b5f.tar.bz2 xen-fec1c620d9903766b01f802e871cc1eecb039b5f.zip | |
xen: Don't BUG_ON() PoD operations on a non-translated guest.
This is XSA-14 / CVE-2012-3496
Signed-off-by: Tim Deegan <tim@xen.org>
Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
Tested-by: Ian Campbell <ian.campbell@citrix.com>
| -rw-r--r-- | xen/arch/x86/mm/p2m.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c index 787b4be6a3..54940338d2 100644 --- a/xen/arch/x86/mm/p2m.c +++ b/xen/arch/x86/mm/p2m.c @@ -2058,7 +2058,8 @@ guest_physmap_mark_populate_on_demand(struct domain *d, unsigned long gfn, int pod_count = 0; int rc = 0; - BUG_ON(!paging_mode_translate(d)); + if ( !paging_mode_translate(d) ) + return -EINVAL; rc = gfn_check_limit(d, gfn, order); if ( rc != 0 ) |