diff options
| author | Jan Beulich <jbeulich@suse.com> | 2013-10-22 12:06:43 +0200 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-10-22 12:06:43 +0200 |
| commit | f17eab34ef3d53920816771f4ab5f907160e6ca6 (patch) | |
| tree | e81fcb60e20ce80ee81988d0c2ebaf698fe1e196 | |
| parent | 0f72e5d7608e01a79f26a8601a3ea289fa52589f (diff) | |
| download | xen-f17eab34ef3d53920816771f4ab5f907160e6ca6.tar.gz xen-f17eab34ef3d53920816771f4ab5f907160e6ca6.tar.bz2 xen-f17eab34ef3d53920816771f4ab5f907160e6ca6.zip | |
x86: add address validity check to guest_map_l1e()
Just like for guest_get_eff_l1e() this prevents accessing as page
tables (and with the wrong memory attribute) internal data inside Xen
happening to be mapped with 1Gb pages.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
master commit: d06a0d715ec1423b6c42141ab1b0ff69a3effb56
master date: 2013-10-11 09:29:43 +0200
| -rw-r--r-- | xen/include/asm-x86/paging.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/xen/include/asm-x86/paging.h b/xen/include/asm-x86/paging.h index ee35dff865..60335ed756 100644 --- a/xen/include/asm-x86/paging.h +++ b/xen/include/asm-x86/paging.h @@ -382,7 +382,8 @@ guest_map_l1e(struct vcpu *v, unsigned long addr, unsigned long *gl1mfn) return paging_get_hostmode(v)->guest_map_l1e(v, addr, gl1mfn); /* Find this l1e and its enclosing l1mfn in the linear map */ - if ( __copy_from_user(&l2e, + if ( !__addr_ok(addr) || + __copy_from_user(&l2e, &__linear_l2_table[l2_linear_offset(addr)], sizeof(l2_pgentry_t)) != 0 ) return NULL; |