Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:Update
xen.7316
xsa255-1.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa255-1.patch of Package xen.7316
gnttab/ARM: don't corrupt shared GFN array ... by writing status GFNs to it. Introduce a second array instead. Also implement gnttab_status_gmfn() properly now that the information is suitably being tracked. While touching it anyway, remove a misguided (but luckily benign) upper bound check from gnttab_shared_gmfn(): We should never access beyond the bounds of that array. This is part of XSA-255. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> --- a/xen/arch/arm/domain.c +++ b/xen/arch/arm/domain.c @@ -428,19 +428,37 @@ void startup_cpu_idle_loop(void) struct domain *alloc_domain_struct(void) { struct domain *d; + unsigned int i, max_status_frames; + BUILD_BUG_ON(sizeof(*d) > PAGE_SIZE); d = alloc_xenheap_pages(0, 0); if ( d == NULL ) return NULL; clear_page(d); - d->arch.grant_table_gpfn = xzalloc_array(xen_pfn_t, max_grant_frames); + + d->arch.grant_shared_gfn = xmalloc_array(xen_pfn_t, max_grant_frames); + max_status_frames = grant_to_status_frames(max_grant_frames); + d->arch.grant_status_gfn = xmalloc_array(xen_pfn_t, max_status_frames); + if ( !d->arch.grant_shared_gfn || !d->arch.grant_status_gfn ) + { + free_domain_struct(d); + return NULL; + } + + for ( i = 0; i < max_grant_frames; ++i ) + d->arch.grant_shared_gfn[i] = INVALID_GFN; + + for ( i = 0; i < max_status_frames; ++i ) + d->arch.grant_status_gfn[i] = INVALID_GFN; + return d; } void free_domain_struct(struct domain *d) { - xfree(d->arch.grant_table_gpfn); + xfree(d->arch.grant_shared_gfn); + xfree(d->arch.grant_status_gfn); free_xenheap_page(d); } --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -1036,6 +1036,7 @@ int xenmem_add_to_physmap_one( int rc; p2m_type_t t; struct page_info *page = NULL; + bool_t status = 0; switch ( space ) { @@ -1053,6 +1054,7 @@ int xenmem_add_to_physmap_one( mfn = virt_to_mfn(d->grant_table->status[idx]); else mfn = INVALID_MFN; + status = 1; } else { @@ -1068,7 +1070,10 @@ int xenmem_add_to_physmap_one( if ( mfn != INVALID_MFN ) { - d->arch.grant_table_gpfn[idx] = gpfn; + if ( status ) + d->arch.grant_status_gfn[idx] = gpfn; + else + d->arch.grant_shared_gfn[idx] = gpfn; t = p2m_ram_rw; } --- a/xen/include/asm-arm/domain.h +++ b/xen/include/asm-arm/domain.h @@ -51,7 +51,8 @@ struct arch_domain uint64_t vttbr; struct hvm_domain hvm_domain; - xen_pfn_t *grant_table_gpfn; + xen_pfn_t *grant_shared_gfn; + xen_pfn_t *grant_status_gfn; struct io_handler io_handlers; /* Continuable domain_relinquish_resources(). */ --- a/xen/include/asm-arm/grant_table.h +++ b/xen/include/asm-arm/grant_table.h @@ -15,7 +15,6 @@ int replace_grant_host_mapping(unsigned unsigned long new_gpaddr, unsigned int flags); void gnttab_mark_dirty(struct domain *d, unsigned long l); #define gnttab_create_status_page(d, t, i) do {} while (0) -#define gnttab_status_gmfn(d, t, i) (0) #define gnttab_release_host_mappings(domain) 1 static inline int replace_grant_supported(void) { @@ -30,8 +29,12 @@ static inline int replace_grant_supporte } while ( 0 ) #define gnttab_shared_gmfn(d, t, i) \ - ( ((i >= nr_grant_frames(d->grant_table)) && \ - (i < max_grant_frames)) ? 0 : (d->arch.grant_table_gpfn[i])) + (((i) >= nr_grant_frames(t)) ? INVALID_GFN \ + : (d)->arch.grant_shared_gfn[i]) + +#define gnttab_status_gmfn(d, t, i) \ + (((i) >= nr_status_frames(t)) ? INVALID_GFN \ + : (d)->arch.grant_status_gfn[i]) #define gnttab_need_iommu_mapping(d) \ (is_domain_direct_mapped(d) && need_iommu(d))
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor