WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

[Xen-devel] [PATCH][RESEND][Builder] Check if v_end wraps around to 0

To: "Keir Fraser" <Keir.Fraser@xxxxxxxxxxxx>
Subject: [Xen-devel] [PATCH][RESEND][Builder] Check if v_end wraps around to 0
From: "Puthiyaparambil, Aravindh" <aravindh.puthiyaparambil@xxxxxxxxxx>
Date: Wed, 7 Jun 2006 10:54:16 -0400
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Wed, 07 Jun 2006 07:54:57 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcaFZBC8vi3/zQnJTki7+zhpsicNVQAR75qQASOIdRA=
Thread-topic: [PATCH][RESEND][Builder] Check if v_end wraps around to 0
This patch adds a check to see if v_end in setup_guest() wraps around to
0 and lets the builder exit gracefully when it does.

Signed-off-by: Aravindh Puthiyaparambil
<aravindh.puthiyaparambil@xxxxxxxxxx>

> -----Original Message-----
> From: Keir Fraser [mailto:Keir.Fraser@xxxxxxxxxxxx]
> Sent: Thursday, June 01, 2006 6:14 AM
> To: Puthiyaparambil, Aravindh
> Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
> Subject: Re: Malformed image causing builder to crash
> 
> 
> On 31 May 2006, at 18:53, Puthiyaparambil, Aravindh wrote:
> 
> > An image with VIRT_START and ELF_PADDR_OFFSET equal to 0 and its
linker
> > entry at 0xffffffff80000000 (Is this is an malformed image?) causes
the
> > builder to crash in loadelfimage() [line 235] because parray is
going
> > out of bounds. Output from the builder is show below. What seems to
be
> > happening is that in setup_guest(), the variable v_end is becoming
zero
> > after the "for ( nr_pt_pages = 2; ; nr_pt_pages++ )" loop. Also note
> > that the value of nr_pt_pages is very large. The reason is that
> > dsi->v_start is 0 which throws things off. But this is totally valid
so
> > I am not sure what checks need to be introduced to stop this from
> > happening. Should the bounds check for the array be reintroduced?
> 
> The problem is almost certainly a wrap in
> xc_linux_build.c:setup_guest(). v_end is taken from parseelfimage()
and
> then incremented to make room for initrd, page tables, etc. If that
> wraps round to zero then the size check will pass and things will
> generally be screwed.
> 
> We probably need to take care whenever we increment v_end to ensure
> that 'inc < -v_end'.
> 
>   -- Keir

Attachment: libxc_vend.patch
Description: libxc_vend.patch

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
<Prev in Thread] Current Thread [Next in Thread>