[Pkg-xen-changes] [xen] 10/17: x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE

[Bastian Blank]

This is an automated email from the git hooks/post-receive script.

waldi pushed a commit to branch develop
in repository xen.

commit 09fcd23db55b6043ae40be55e91f508a2c9dbd31
Author: Andrew Cooper <andrew.cooper3 at citrix.com>
Date:   Thu Nov 20 17:43:39 2014 +0100

    x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE
    
    Any domain which can pass the XSM check against a translated guest can cause a
    page reference to be leaked.
    
    While shuffling the order of checks, drop the quite-pointless MEM_LOG().  This
    brings the check in line with similar checks in the vicinity.
    
    Discovered while reviewing the XSA-109/110 followup series.
    
    This is XSA-113.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3 at citrix.com>
    Reviewed-by: Jan Beulich <jbeulich at suse.com>
    Reviewed-by: Tim Deegan <tim at xen.org>
    
    Patch-Name: CVE-2014-9030.diff
---
 xen/arch/x86/mm.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index f88323f..db0b6fe 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3634,6 +3634,12 @@ long do_mmu_update(
 
         case MMU_MACHPHYS_UPDATE:
 
+            if ( unlikely(paging_mode_translate(pg_owner)) )
+            {
+                rc = -EINVAL;
+                break;
+            }
+
             mfn = req.ptr >> PAGE_SHIFT;
             gpfn = req.val;
 
@@ -3653,13 +3659,6 @@ long do_mmu_update(
                 break;
             }
 
-            if ( unlikely(paging_mode_translate(pg_owner)) )
-            {
-                MEM_LOG("Mach-phys update on auto-translate guest");
-                rc = -EINVAL;
-                break;
-            }
-
             set_gpfn_from_mfn(mfn, gpfn);
 
             paging_mark_dirty(pg_owner, mfn);

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-xen/xen.git