File 546e1916-x86-mm-fix-a-reference-counting-error-in-MMU_MACHPHYS_UPDATE.patch of Package xen.openSUSE_13.1_Update

# HG changeset patch
# User Andrew Cooper <andrew.cooper3@citrix.com>
# Date 1416501904 -3600
# Node ID 9fe846e233ef3f9d0863319dcede937ca89b7605
# Parent  3f0c0668ab3f3ca0bc10978ccd766ea1e50d6747
x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE

Any domain which can pass the XSM check against a translated guest can cause a
page reference to be leaked.

While shuffling the order of checks, drop the quite-pointless MEM_LOG().  This
brings the check in line with similar checks in the vicinity.

Discovered while reviewing the XSA-109/110 followup series.

This is XSA-113.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Tim Deegan <tim@xen.org>

diff -r 3f0c0668ab3f -r 9fe846e233ef xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c	Tue Nov 18 14:31:21 2014 +0100
+++ b/xen/arch/x86/mm.c	Thu Nov 20 17:45:04 2014 +0100
@@ -3635,6 +3635,12 @@ long do_mmu_update(
 
         case MMU_MACHPHYS_UPDATE:
 
+            if ( unlikely(paging_mode_translate(pg_owner)) )
+            {
+                rc = -EINVAL;
+                break;
+            }
+
             mfn = req.ptr >> PAGE_SHIFT;
             gpfn = req.val;
 
@@ -3654,13 +3660,6 @@ long do_mmu_update(
                 break;
             }
 
-            if ( unlikely(paging_mode_translate(pg_owner)) )
-            {
-                MEM_LOG("Mach-phys update on auto-translate guest");
-                rc = -EINVAL;
-                break;
-            }
-
             set_gpfn_from_mfn(mfn, gpfn);
 
             paging_mark_dirty(pg_owner, mfn);