From mboxrd@z Thu Jan  1 00:00:00 1970
From: Samuel Thibault <samuel.thibault@eu.citrix.com>
Subject: [PATCH] grant table and bogus mfns
Date: Fri, 9 Nov 2007 15:13:09 +0000
Message-ID: <20071109151309.GE3841@implementation.uk.xensource.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="lEGEL1/lMxI0MVQ2"
Return-path: <xen-devel-bounces@lists.xensource.com>
Resent-Message-ID: <20071109173926.GU3841@implementation.uk.xensource.com>
Resent-To: xen-devel@lists.xensource.com
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org


--lEGEL1/lMxI0MVQ2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi,

While developping a frontend, I noticed that if I gave a grant on mfn 0
to a backend (which is bogus), that backend would happily be allowed to
map it, and hence Oops...

This is because mfn 0 is considered as iomem, and in that case
gnttab_map_grant_ref only checks that the target domain is allowed to
access it.  The patch below makes it check that the source domain was
allowed to access it (and then give the target access to it).

Samuel

Signed-Off-By: Samuel Thibault <samuel.thibault@eu.citrix.com>

diff -r 4bf62459d45a xen/common/grant_table.c
--- a/xen/common/grant_table.c	Wed Nov 07 11:29:38 2007 +0000
+++ b/xen/common/grant_table.c	Fri Nov 09 15:01:57 2007 +0000
@@ -335,7 +335,8 @@ __gnttab_map_grant_ref(
         if ( iomem_page_test(frame, mfn_to_page(frame)) )
         {
             is_iomem = 1;
-            if ( iomem_permit_access(ld, frame, frame) )
+            if ( !iomem_access_permitted(rd, frame, frame)
+                  || iomem_permit_access(ld, frame, frame) )
             {
                 gdprintk(XENLOG_WARNING, 
                          "Could not permit access to grant frame "

--lEGEL1/lMxI0MVQ2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=patch

diff -r 4bf62459d45a xen/common/grant_table.c
--- a/xen/common/grant_table.c	Wed Nov 07 11:29:38 2007 +0000
+++ b/xen/common/grant_table.c	Fri Nov 09 15:01:57 2007 +0000
@@ -335,7 +335,8 @@ __gnttab_map_grant_ref(
         if ( iomem_page_test(frame, mfn_to_page(frame)) )
         {
             is_iomem = 1;
-            if ( iomem_permit_access(ld, frame, frame) )
+            if ( !iomem_access_permitted(rd, frame, frame)
+                  || iomem_permit_access(ld, frame, frame) )
             {
                 gdprintk(XENLOG_WARNING, 
                          "Could not permit access to grant frame "

--lEGEL1/lMxI0MVQ2
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

--lEGEL1/lMxI0MVQ2--