27 lines
1.0 KiB
Diff
27 lines
1.0 KiB
Diff
|
# Commit d06a0d715ec1423b6c42141ab1b0ff69a3effb56
|
||
|
|
# Date 2013-10-11 09:29:43 +0200
|
||
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
x86: add address validity check to guest_map_l1e()
|
||
|
|
|
||
|
|
Just like for guest_get_eff_l1e() this prevents accessing as page
|
||
|
|
tables (and with the wrong memory attribute) internal data inside Xen
|
||
|
|
happening to be mapped with 1Gb pages.
|
||
|
|
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Reviewed-by: Andrew Cooper <andrew.cooper@citrix.com>
|
||
|
|
Acked-by: Keir Fraser <keir@xen.org>
|
||
|
|
|
||
|
|
--- a/xen/include/asm-x86/paging.h
|
||
|
|
+++ b/xen/include/asm-x86/paging.h
|
||
|
|
@@ -360,7 +360,8 @@ guest_map_l1e(struct vcpu *v, unsigned l
|
||
|
|
return paging_get_hostmode(v)->guest_map_l1e(v, addr, gl1mfn);
|
||
|
|
|
||
|
|
/* Find this l1e and its enclosing l1mfn in the linear map */
|
||
|
|
- if ( __copy_from_user(&l2e,
|
||
|
|
+ if ( !__addr_ok(addr) ||
|
||
|
|
+ __copy_from_user(&l2e,
|
||
|
|
&__linear_l2_table[l2_linear_offset(addr)],
|
||
|
|
sizeof(l2_pgentry_t)) != 0 )
|
||
|
|
return NULL;
|