60 lines
2.3 KiB
Diff
60 lines
2.3 KiB
Diff
|
# HG changeset patch
|
||
|
|
# User Ian Campbell <Ian.Campbell@citrix.com>
|
||
|
|
# Date 1357906947 0
|
||
|
|
# Node ID ba2d73234d73fc0faa027cd9bdfd3ac90642733c
|
||
|
|
# Parent 84d87ca765be81c215ef3b67d2ed71acfba73553
|
||
|
|
libxc: x86: ensure that the initial mapping fits into the guest's memory
|
||
|
|
|
||
|
|
In particular we need to check that adding 512KB of slack and
|
||
|
|
rounding up to a 4MB boundary do not overflow the guest's memory
|
||
|
|
allocation. Otherwise we run off the end of the p2m when building the
|
||
|
|
guest's initial page tables and populate them with garbage.
|
||
|
|
|
||
|
|
Wei noticed this when build tiny (2MB) mini-os domains.
|
||
|
|
|
||
|
|
Reported-by: Wei Liu <Wei.Liu2@citrix.com>
|
||
|
|
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
Acked-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Committed-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
|
||
|
|
--- a/tools/libxc/xc_dom_core.c
|
||
|
|
+++ b/tools/libxc/xc_dom_core.c
|
||
|
|
@@ -871,7 +871,8 @@ int xc_dom_build_image(struct xc_dom_ima
|
||
|
|
goto err;
|
||
|
|
if ( dom->arch_hooks->count_pgtables )
|
||
|
|
{
|
||
|
|
- dom->arch_hooks->count_pgtables(dom);
|
||
|
|
+ if ( dom->arch_hooks->count_pgtables(dom) != 0 )
|
||
|
|
+ goto err;
|
||
|
|
if ( (dom->pgtables > 0) &&
|
||
|
|
(xc_dom_alloc_segment(dom, &dom->pgtables_seg, "page tables", 0,
|
||
|
|
dom->pgtables * page_size) != 0) )
|
||
|
|
--- a/tools/libxc/xc_dom_x86.c
|
||
|
|
+++ b/tools/libxc/xc_dom_x86.c
|
||
|
|
@@ -82,6 +82,7 @@ static int count_pgtables(struct xc_dom_
|
||
|
|
{
|
||
|
|
int pages, extra_pages;
|
||
|
|
xen_vaddr_t try_virt_end;
|
||
|
|
+ xen_pfn_t try_pfn_end;
|
||
|
|
|
||
|
|
extra_pages = dom->alloc_bootstack ? 1 : 0;
|
||
|
|
extra_pages += dom->extra_pages;
|
||
|
|
@@ -91,6 +92,17 @@ static int count_pgtables(struct xc_dom_
|
||
|
|
{
|
||
|
|
try_virt_end = round_up(dom->virt_alloc_end + pages * PAGE_SIZE_X86,
|
||
|
|
bits_to_mask(22)); /* 4MB alignment */
|
||
|
|
+
|
||
|
|
+ try_pfn_end = (try_virt_end - dom->parms.virt_base) >> PAGE_SHIFT_X86;
|
||
|
|
+
|
||
|
|
+ if ( try_pfn_end > dom->total_pages )
|
||
|
|
+ {
|
||
|
|
+ xc_dom_panic(dom->xch, XC_OUT_OF_MEMORY,
|
||
|
|
+ "%s: not enough memory for initial mapping (%#"PRIpfn" > %#"PRIpfn")",
|
||
|
|
+ __FUNCTION__, try_pfn_end, dom->total_pages);
|
||
|
|
+ return -ENOMEM;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
dom->pg_l4 =
|
||
|
|
nr_page_tables(dom, dom->parms.virt_base, try_virt_end, l4_bits);
|
||
|
|
dom->pg_l3 =
|