From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: [Patch v2] x86/mm: Prevent leaking domain mappings in paging_log_dirty_op() Date: Tue, 10 Dec 2013 14:50:43 +0000 Message-ID: <1386687043-8266-1-git-send-email-andrew.cooper3@citrix.com> References: <52A73736020000780010BE37@nat28.tlf.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <52A73736020000780010BE37@nat28.tlf.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Xen-devel Cc: Andrew Cooper , Keir Fraser , Tim Deegan List-Id: xen-devel@lists.xenproject.org Coverity ID: 1135374 1135375 1135376 1135377 If {copy_to,clear}_guest_offset() fails, we would leak the domain mappings for l4 thru l1. Fixing this requires having conditional unmaps on the faulting path, which in turn requires explicitly initialising the pointers to NULL because of the early ENOMEM exit. Signed-off-by: Andrew Cooper CC: Keir Fraser Reviewed-by: Jan Beulich CC: Tim Deegan --- Changes in v2: * Reorder unmaps until after the unlock/unpause (Suggested by Jan) --- xen/arch/x86/mm/paging.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c index 4ba7669..21344e5 100644 --- a/xen/arch/x86/mm/paging.c +++ b/xen/arch/x86/mm/paging.c @@ -330,8 +330,8 @@ int paging_log_dirty_op(struct domain *d, struct xen_domctl_shadow_op *sc) { int rv = 0, clean = 0, peek = 1; unsigned long pages = 0; - mfn_t *l4, *l3, *l2; - unsigned long *l1; + mfn_t *l4 = NULL, *l3 = NULL, *l2 = NULL; + unsigned long *l1 = NULL; int i4, i3, i2; domain_pause(d); @@ -434,6 +434,16 @@ int paging_log_dirty_op(struct domain *d, struct xen_domctl_shadow_op *sc) out: paging_unlock(d); domain_unpause(d); + + if ( l1 ) + unmap_domain_page(l1); + if ( l2 ) + unmap_domain_page(l2); + if ( l3 ) + unmap_domain_page(l3); + if ( l4 ) + unmap_domain_page(l4); + return rv; } -- 1.7.10.4