[Xen-changelog] [xen stable-4.3] x86: add address validity check to guest_map_l1e()

[patchbot@xxxxxxx]

commit 6ab2551502847834c9c4e581d546ccfcf72a51a6
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Oct 14 11:17:45 2013 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Oct 14 11:17:45 2013 +0200

    x86: add address validity check to guest_map_l1e()
    
    Just like for guest_get_eff_l1e() this prevents accessing as page
    tables (and with the wrong memory attribute) internal data inside Xen
    happening to be mapped with 1Gb pages.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper@xxxxxxxxxx>
    Acked-by: Keir Fraser <keir@xxxxxxx>
    master commit: d06a0d715ec1423b6c42141ab1b0ff69a3effb56
    master date: 2013-10-11 09:29:43 +0200
---
 xen/include/asm-x86/paging.h |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/xen/include/asm-x86/paging.h b/xen/include/asm-x86/paging.h
index 105a0ca..e957b2f 100644
--- a/xen/include/asm-x86/paging.h
+++ b/xen/include/asm-x86/paging.h
@@ -360,7 +360,8 @@ guest_map_l1e(struct vcpu *v, unsigned long addr, unsigned 
long *gl1mfn)
         return paging_get_hostmode(v)->guest_map_l1e(v, addr, gl1mfn);
 
     /* Find this l1e and its enclosing l1mfn in the linear map */
-    if ( __copy_from_user(&l2e, 
+    if ( !__addr_ok(addr) ||
+         __copy_from_user(&l2e,
                           &__linear_l2_table[l2_linear_offset(addr)],
                           sizeof(l2_pgentry_t)) != 0 )
         return NULL;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog