From 0725f326358cbb2ba7f9626976e346b963d74c37 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Tue, 17 Dec 2013 16:38:07 +0100 Subject: [PATCH] x86/mm: Prevent leaking domain mappings in paging_log_dirty_op() Coverity ID: 1135374 1135375 1135376 1135377 If {copy_to,clear}_guest_offset() fails, we would leak the domain mappings for l4 thru l1. Fixing this requires having conditional unmaps on the faulting path, which in turn requires explicitly initialising the pointers to NULL because of the early ENOMEM exit. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Acked-by: Tim Deegan --- xen/arch/x86/mm/paging.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c index 4ba7669a34..21344e50ff 100644 --- a/xen/arch/x86/mm/paging.c +++ b/xen/arch/x86/mm/paging.c @@ -330,8 +330,8 @@ int paging_log_dirty_op(struct domain *d, struct xen_domctl_shadow_op *sc) { int rv = 0, clean = 0, peek = 1; unsigned long pages = 0; - mfn_t *l4, *l3, *l2; - unsigned long *l1; + mfn_t *l4 = NULL, *l3 = NULL, *l2 = NULL; + unsigned long *l1 = NULL; int i4, i3, i2; domain_pause(d); @@ -434,6 +434,16 @@ int paging_log_dirty_op(struct domain *d, struct xen_domctl_shadow_op *sc) out: paging_unlock(d); domain_unpause(d); + + if ( l1 ) + unmap_domain_page(l1); + if ( l2 ) + unmap_domain_page(l2); + if ( l3 ) + unmap_domain_page(l3); + if ( l4 ) + unmap_domain_page(l4); + return rv; } -- 2.30.2