Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:Update
xen.481
546e1916-x86-mm-fix-a-reference-counting-error-...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 546e1916-x86-mm-fix-a-reference-counting-error-in-MMU_MACHPHYS_UPDATE.patch of Package xen.481
References: bsc#906439 CVE-2014-9030 XSA-113 # Commit 6913fa31fa898f45ecc3b00e2397b8ebc75c8df4 # Date 2014-11-20 17:38:46 +0100 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Jan Beulich <jbeulich@suse.com> x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE Any domain which can pass the XSM check against a translated guest can cause a page reference to be leaked. While shuffling the order of checks, drop the quite-pointless MEM_LOG(). This brings the check in line with similar checks in the vicinity. Discovered while reviewing the XSA-109/110 followup series. This is XSA-113. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Tim Deegan <tim@xen.org> --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -3635,6 +3635,12 @@ long do_mmu_update( case MMU_MACHPHYS_UPDATE: + if ( unlikely(paging_mode_translate(pg_owner)) ) + { + rc = -EINVAL; + break; + } + mfn = req.ptr >> PAGE_SHIFT; gpfn = req.val; @@ -3654,13 +3660,6 @@ long do_mmu_update( break; } - if ( unlikely(paging_mode_translate(pg_owner)) ) - { - MEM_LOG("Mach-phys update on auto-translate guest"); - rc = -EINVAL; - break; - } - set_gpfn_from_mfn(mfn, gpfn); paging_mark_dirty(pg_owner, mfn);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor