Re: [PATCH 1/3] x86: tighten page table owner checking in do_mmu_update()

[Andrew Cooper <andrew.cooper3@citrix.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1370 bytes --]

On 20/11/14 10:11, Jan Beulich wrote:
> MMU_MACHPHYS_UPDATE, not manipulating page tables, shouldn't ignore
> a bad page table domain being specified.
>
> Also pt_owner can't be NULL when reaching the "out" label, so the
> respective check can be dropped.

Yes it can.

Failing

    if ( (pg_owner = get_pg_owner((uint16_t)foreigndom)) == NULL )
    {
        rc = -ESRCH;
        goto out;
    }

around line 3462 will cause pt_owner to be NULL at the out label.

~Andrew

>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> Acked-by: Tim Deegan <tim@xen.org>
>
> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -3618,6 +3618,11 @@ long do_mmu_update(
>          break;
>  
>          case MMU_MACHPHYS_UPDATE:
> +            if ( unlikely(d != pt_owner) )
> +            {
> +                rc = -EPERM;
> +                break;
> +            }
>  
>              mfn = req.ptr >> PAGE_SHIFT;
>              gpfn = req.val;
> @@ -3694,7 +3699,7 @@ long do_mmu_update(
>      perfc_add(num_page_updates, i);
>  
>   out:
> -    if ( pt_owner && (pt_owner != d) )
> +    if ( pt_owner != d )
>          rcu_unlock_domain(pt_owner);
>  
>      /* Add incremental work we have done to the @done output parameter. */
>
>
>
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel


[-- Attachment #1.2: Type: text/html, Size: 2401 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel