[Xen-changelog] [xen stable-4.3] x86/mm: Prevent leaking domain mappings in paging_log_dirty_op()

[patchbot@xxxxxxx]

commit 4cfd2132b5afb959226eafd8dd3be0a69f947e2a
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Fri Jan 10 11:08:35 2014 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Jan 10 11:08:35 2014 +0100

    x86/mm: Prevent leaking domain mappings in paging_log_dirty_op()
    
    Coverity ID: 1135374 1135375 1135376 1135377
    
    If {copy_to,clear}_guest_offset() fails, we would leak the domain mappings 
for
    l4 thru l1.
    
    Fixing this requires having conditional unmaps on the faulting path, which 
in
    turn requires explicitly initialising the pointers to NULL because of the
    early ENOMEM exit.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <JBeulich@xxxxxxxx>
    Acked-by: Tim Deegan <tim@xxxxxxx>
    master commit: 0725f326358cbb2ba7f9626976e346b963d74c37
    master date: 2013-12-17 16:38:07 +0100
---
 xen/arch/x86/mm/paging.c |   14 ++++++++++++--
 1 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index 4ba7669..21344e5 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -330,8 +330,8 @@ int paging_log_dirty_op(struct domain *d, struct 
xen_domctl_shadow_op *sc)
 {
     int rv = 0, clean = 0, peek = 1;
     unsigned long pages = 0;
-    mfn_t *l4, *l3, *l2;
-    unsigned long *l1;
+    mfn_t *l4 = NULL, *l3 = NULL, *l2 = NULL;
+    unsigned long *l1 = NULL;
     int i4, i3, i2;
 
     domain_pause(d);
@@ -434,6 +434,16 @@ int paging_log_dirty_op(struct domain *d, struct 
xen_domctl_shadow_op *sc)
  out:
     paging_unlock(d);
     domain_unpause(d);
+
+    if ( l1 )
+        unmap_domain_page(l1);
+    if ( l2 )
+        unmap_domain_page(l2);
+    if ( l3 )
+        unmap_domain_page(l3);
+    if ( l4 )
+        unmap_domain_page(l4);
+
     return rv;
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog