This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-changelog] [xen-unstable] [XEN] gnttab: Initialise maptrack->flags

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] [XEN] gnttab: Initialise maptrack->flags
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 06 Sep 2006 13:30:14 +0000
Delivery-date: Wed, 06 Sep 2006 06:30:40 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User ssmith@xxxxxxxxxxxxxxxxxxxxxxxxxx
# Node ID 1de184deaa9c6fce2d7f12913b9da365e1accf86
# Parent  780409e8f0bae3bd2d1deae3f8f8fde2fd234755
[XEN] gnttab: Initialise maptrack->flags

__gnttab_unmap_grant_ref verifies the validity of the handle by
checking it against maptrack_limit and making sure that the flags
field at the given handle is non-zero.

This means that the flags of an unused handle should be zero in
order to prevent unused handles from getting past this check.

However, we don't seem to set it to zero to begin with when we
allocate the maptrack table.  This could potentially lead to the
corruption of the other domain's internal state, and/or the hypervisor's
internal state.

This patch makes sure that it is zeroed.

Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
 xen/common/grant_table.c |    3 +++
 1 files changed, 3 insertions(+)

diff -r 780409e8f0ba -r 1de184deaa9c xen/common/grant_table.c
--- a/xen/common/grant_table.c  Wed Sep 06 11:42:29 2006 +0100
+++ b/xen/common/grant_table.c  Wed Sep 06 13:16:02 2006 +0100
@@ -156,7 +156,10 @@ __gnttab_map_grant_ref(
         memcpy(new_mt, lgt->maptrack, PAGE_SIZE << lgt->maptrack_order);
         for ( i = lgt->maptrack_limit; i < (lgt->maptrack_limit << 1); i++ )
+        {
             new_mt[i].ref = i+1;
+            new_mt[i].flags = 0;
+        }
         free_xenheap_pages(lgt->maptrack, lgt->maptrack_order);
         lgt->maptrack          = new_mt;

Xen-changelog mailing list

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-changelog] [xen-unstable] [XEN] gnttab: Initialise maptrack->flags, Xen patchbot-unstable <=