KEXEC: fix kexec_get_range_compat to fail vocally

[Andrew Cooper <andrew.cooper3@citrix.com>]

[-- Attachment #1: Type: text/plain, Size: 250 bytes --]

I am not sure that this is the only instance, but it is really not
acceptable to hand truncated pointers or sizes for physical memory to dom0.

-- 
Andrew Cooper - Dom0 Kernel Engineer, Citrix XenServer
T: +44 (0)1223 225 900, http://www.citrix.com


[-- Attachment #2: KEXEC-fix-kexec_get_range_compat.patch --]
[-- Type: text/x-patch, Size: 820 bytes --]

KEXEC: fix kexec_get_range_compat to fail vocally.

Fail with -ERANGE rather than silently truncating 64bit values (a
physical address and size) into 32bit integers for dom0 to consume.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff -r df7cec2c6c03 xen/common/kexec.c
--- a/xen/common/kexec.c
+++ b/xen/common/kexec.c
@@ -395,6 +395,12 @@ static int kexec_get_range_compat(XEN_GU
 
     ret = kexec_get_range_internal(&range);
 
+#define RANGE_MASK (((unsigned long)-1) & ~((unsigned int)-1))
+    /* Dont silently truncate physical addresses or sizes. */
+    if ( range.start & RANGE_MASK || range.size & RANGE_MASK )
+        return -ERANGE;
+#undef RANGE_MASK
+
     if ( ret == 0 ) {
         XLAT_kexec_range(&compat_range, &range);
         if ( unlikely(copy_to_guest(uarg, &compat_range, 1)) )

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel