WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-changelog

[Xen-changelog] [xen-3.0-testing] [TOOLS] Fix domain builder to carefull

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-3.0-testing] [TOOLS] Fix domain builder to carefully check that mapped memory area
From: Xen patchbot-3.0-testing <patchbot-3.0-testing@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 08 Jun 2006 15:00:36 +0000
Delivery-date: Thu, 08 Jun 2006 09:02:36 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User kaf24@xxxxxxxxxxxxxxxxxxxx
# Node ID 1de04b7a58366cf659876239036bf2323eb0b3b3
# Parent  694a37bf37068610e6167564096e99984815a7be
[TOOLS] Fix domain builder to carefully check that mapped memory area
does not overflow and wrap to zero.
Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
xen-unstable changeset:   10297:8c64169a05d3fda5d0b3792edd7beaea18c2ab83
xen-unstable date:        Thu Jun  8 09:52:04 2006 +0100
---
 tools/libxc/xc_linux_build.c |   61 +++++++++++++++++++++++++++++++++++--------
 1 files changed, 50 insertions(+), 11 deletions(-)

diff -r 694a37bf3706 -r 1de04b7a5836 tools/libxc/xc_linux_build.c
--- a/tools/libxc/xc_linux_build.c      Wed Jun 07 15:51:19 2006 +0100
+++ b/tools/libxc/xc_linux_build.c      Thu Jun 08 09:57:53 2006 +0100
@@ -603,6 +603,16 @@ static int compat_check(int xc_handle, s
     return 1;
 }
 
+static inline int increment_ulong(unsigned long *pval, unsigned long inc)
+{
+    if ( inc >= -*pval )
+    {
+        ERROR("Value wrapped to zero: image too large?");
+        return 0;
+    }
+    *pval += inc;
+    return 1;
+}
 
 static int setup_guest(int xc_handle,
                        uint32_t dom,
@@ -703,30 +713,59 @@ static int setup_guest(int xc_handle,
      * which we solve by exhaustive search.
      */
     v_end = round_pgup(dsi.v_end);
+    if ( v_end == 0 )
+    {
+        ERROR("End of mapped kernel image too close to end of memory");
+        goto error_out;
+    }
     vinitrd_start = v_end;
-    v_end += round_pgup(initrd->len);
+    if ( !increment_ulong(&v_end, round_pgup(initrd->len)) )
+        goto error_out;
     vphysmap_start = v_end;
-    v_end += round_pgup(nr_pages * sizeof(unsigned long));
+    if ( !increment_ulong(&v_end, round_pgup(nr_pages * sizeof(long))) )
+        goto error_out;
     vstartinfo_start = v_end;
-    v_end += PAGE_SIZE;
+    if ( !increment_ulong(&v_end, PAGE_SIZE) )
+        goto error_out;
     vstoreinfo_start = v_end;
-    v_end += PAGE_SIZE;
+    if ( !increment_ulong(&v_end, PAGE_SIZE) )
+        goto error_out;
     vconsole_start = v_end;
-    v_end += PAGE_SIZE;
+    if ( !increment_ulong(&v_end, PAGE_SIZE) )
+        goto error_out;
     if ( shadow_mode_enabled ) {
         vsharedinfo_start = v_end;
-        v_end += PAGE_SIZE;
+        if ( !increment_ulong(&v_end, PAGE_SIZE) )
+            goto error_out;
     }
     vpt_start = v_end;
 
     for ( nr_pt_pages = 2; ; nr_pt_pages++ )
     {
-        vpt_end          = vpt_start + (nr_pt_pages * PAGE_SIZE);
-        vstack_start     = vpt_end;
-        vstack_end       = vstack_start + PAGE_SIZE;
-        v_end            = (vstack_end + (1UL<<22)-1) & ~((1UL<<22)-1);
+        /* vpt_end = vpt_start + (nr_pt_pages * PAGE_SIZE); */
+        vpt_end = vpt_start;
+        if ( !increment_ulong(&vpt_end, nr_pt_pages * PAGE_SIZE) )
+            goto error_out;
+
+        vstack_start = vpt_end;
+        /* vstack_end = vstack_start + PAGE_SIZE; */
+        vstack_end = vstack_start;
+        if ( !increment_ulong(&vstack_end, PAGE_SIZE) )
+            goto error_out;
+
+        /* v_end = (vstack_end + (1UL<<22)-1) & ~((1UL<<22)-1); */
+        v_end = vstack_end;
+        if ( !increment_ulong(&v_end, (1UL<<22)-1) )
+            goto error_out;
+        v_end &= ~((1UL<<22)-1);
+
         if ( (v_end - vstack_end) < (512UL << 10) )
-            v_end += 1UL << 22; /* Add extra 4MB to get >= 512kB padding. */
+        {
+            /* Add extra 4MB to get >= 512kB padding. */
+            if ( !increment_ulong(&v_end, 1UL << 22) )
+                goto error_out;
+        }
+
 #if defined(__i386__)
         if ( dsi.pae_kernel )
         {

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-changelog] [xen-3.0-testing] [TOOLS] Fix domain builder to carefully check that mapped memory area, Xen patchbot-3 . 0-testing <=