[Xen-devel] xen crash in tmem: checking a xen pfn for domain ownership

[Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>]

Does the construct:

  xen_pfn_t gpfn;
  p2m_type_t t;
  unsigned long mfn;

  mfn = mfn_x(gfn_to_mfn(current->domain, gpfn, &t));
  if (t != p2m_ram_rw || cli_mfn == INVALID_MFN)
      return NULL; /* bad */
  return map_domain_page(mfn)

somehow check to ensure that pfn belongs to current->domain?
(See cli_mfn_to_va() in common/tmem_xen.c.)

If not, is there an easy way to perform that check?
(preferably one that works for both HVM and PV guests)

In debugging a tmem Linux-side guest patch, I discovered
that a bad mfn passed by the guest can crash Xen and
I think this assumption might be the problem.

Thanks,
Dan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel