From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 11 Oct 2013 07:29:43 +0000 (+0200)
Subject: x86: add address validity check to guest_map_l1e()
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~6181
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=d06a0d715ec1423b6c42141ab1b0ff69a3effb56;p=xen.git

x86: add address validity check to guest_map_l1e()

Just like for guest_get_eff_l1e() this prevents accessing as page
tables (and with the wrong memory attribute) internal data inside Xen
happening to be mapped with 1Gb pages.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
---

diff --git a/xen/include/asm-x86/paging.h b/xen/include/asm-x86/paging.h
index 105a0ca1b3..e957b2fe23 100644
--- a/xen/include/asm-x86/paging.h
+++ b/xen/include/asm-x86/paging.h
@@ -360,7 +360,8 @@ guest_map_l1e(struct vcpu *v, unsigned long addr, unsigned long *gl1mfn)
         return paging_get_hostmode(v)->guest_map_l1e(v, addr, gl1mfn);
 
     /* Find this l1e and its enclosing l1mfn in the linear map */
-    if ( __copy_from_user(&l2e, 
+    if ( !__addr_ok(addr) ||
+         __copy_from_user(&l2e,
                           &__linear_l2_table[l2_linear_offset(addr)],
                           sizeof(l2_pgentry_t)) != 0 )
         return NULL;