Re: [PATCH 1/2] Xen/mem_event: Validate the response vcpu_id before acting on it.

[Andres Lagar Cavilla <andres@lagarcavilla.org>]

[-- Attachment #1.1: Type: text/plain, Size: 3168 bytes --]

On Thu, Jul 17, 2014 at 9:10 AM, Andrew Cooper <andrew.cooper3@citrix.com>
wrote:

> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Tim Deegan <tim@xen.org>
> CC: Andres Lagar-Cavilla <andres@lagarcavilla.org>
>
Reviewed-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>

> ---
>  xen/arch/x86/mm/mem_sharing.c |   11 ++++++++++-
>  xen/arch/x86/mm/p2m.c         |   22 ++++++++++++++++++++--
>  2 files changed, 30 insertions(+), 3 deletions(-)
>
> diff --git a/xen/arch/x86/mm/mem_sharing.c b/xen/arch/x86/mm/mem_sharing.c
> index 7293f31..ec99266 100644
> --- a/xen/arch/x86/mm/mem_sharing.c
> +++ b/xen/arch/x86/mm/mem_sharing.c
> @@ -596,11 +596,20 @@ int mem_sharing_sharing_resume(struct domain *d)
>      /* Get all requests off the ring */
>      while ( mem_event_get_response(d, &d->mem_event->share, &rsp) )
>      {
> +        struct vcpu *v;
> +
>          if ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
>              continue;
> +
> +        /* Validate the vcpu_id in the response. */
> +        if ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
> +            continue;
> +
> +        v = d->vcpu[rsp.vcpu_id];
> +
>          /* Unpause domain/vcpu */
>          if ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
> -            vcpu_unpause(d->vcpu[rsp.vcpu_id]);
> +            vcpu_unpause(v);
>      }
>
>      return 0;
> diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
> index 642ec28..f213a39 100644
> --- a/xen/arch/x86/mm/p2m.c
> +++ b/xen/arch/x86/mm/p2m.c
> @@ -1290,8 +1290,17 @@ void p2m_mem_paging_resume(struct domain *d)
>      /* Pull all responses off the ring */
>      while( mem_event_get_response(d, &d->mem_event->paging, &rsp) )
>      {
> +        struct vcpu *v;
> +
>          if ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
>              continue;
> +
> +        /* Validate the vcpu_id in the response. */
> +        if ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
> +            continue;
> +
> +        v = d->vcpu[rsp.vcpu_id];
> +
>          /* Fix p2m entry if the page was not dropped */
>          if ( !(rsp.flags & MEM_EVENT_FLAG_DROP_PAGE) )
>          {
> @@ -1310,7 +1319,7 @@ void p2m_mem_paging_resume(struct domain *d)
>          }
>          /* Unpause domain */
>          if ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
> -            vcpu_unpause(d->vcpu[rsp.vcpu_id]);
> +            vcpu_unpause(v);
>      }
>  }
>
> @@ -1418,11 +1427,20 @@ void p2m_mem_access_resume(struct domain *d)
>      /* Pull all responses off the ring */
>      while( mem_event_get_response(d, &d->mem_event->access, &rsp) )
>      {
> +        struct vcpu *v;
> +
>          if ( rsp.flags & MEM_EVENT_FLAG_DUMMY )
>              continue;
> +
> +        /* Validate the vcpu_id in the response. */
> +        if ( (rsp.vcpu_id >= d->max_vcpus) || !d->vcpu[rsp.vcpu_id] )
> +            continue;
> +
> +        v = d->vcpu[rsp.vcpu_id];
> +
>          /* Unpause domain */
>          if ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED )
> -            vcpu_unpause(d->vcpu[rsp.vcpu_id]);
> +            vcpu_unpause(v);
>      }
>  }
>
> --
> 1.7.10.4
>
>

[-- Attachment #1.2: Type: text/html, Size: 4519 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel