[Xen-devel] [PATCH] xen/arm: add_to_physmap_one: Avoid to map mfn 0 if an error occurs

[Julien Grall <julien.grall@xxxxxxxxxx>]

By default, the function add_to_physmap_one set mfn to 0. Some code paths that
result to an error, continue and the map the mfn 0 (valid on ARM) to the
slot given by the guest.

To fix the problem, return directly an error if sanity check has failed.

Signed-off-by: Julien Grall <julien.grall@xxxxxxxxxx>
---
 xen/arch/arm/mm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 474dfef..eaeb0c3 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -981,6 +981,8 @@ static int xenmem_add_to_physmap_one(
             idx &= ~XENMAPIDX_grant_table_status;
             if ( idx < nr_status_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->status[idx]);
+            else
+                return -EINVAL;
         }
         else
         {
@@ -990,6 +992,8 @@ static int xenmem_add_to_physmap_one(
 
             if ( idx < nr_grant_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->shared_raw[idx]);
+            else
+                return -EINVAL;
         }
         
         d->arch.grant_table_gpfn[idx] = gpfn;
@@ -999,6 +1003,8 @@ static int xenmem_add_to_physmap_one(
     case XENMAPSPACE_shared_info:
         if ( idx == 0 )
             mfn = virt_to_mfn(d->shared_info);
+        else
+            return -EINVAL;
         break;
     case XENMAPSPACE_gmfn_foreign:
     {
-- 
1.8.3.1


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel