[Pkg-xen-changes] [xen] 30/36: x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE

[Bastian Blank]

This is an automated email from the git hooks/post-receive script.

waldi pushed a commit to branch feature/4.5.0-rc3
in repository xen.

commit 6b92e12200e1111edb1a72670974606c708ef10f
Author: Andrew Cooper <andrew.cooper3 at citrix.com>
Date:   Thu Nov 20 17:43:39 2014 +0100

    x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE
    
    Any domain which can pass the XSM check against a translated guest can cause a
    page reference to be leaked.
    
    While shuffling the order of checks, drop the quite-pointless MEM_LOG().  This
    brings the check in line with similar checks in the vicinity.
    
    Discovered while reviewing the XSA-109/110 followup series.
    
    This is XSA-113.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3 at citrix.com>
    Reviewed-by: Jan Beulich <jbeulich at suse.com>
    Reviewed-by: Tim Deegan <tim at xen.org>
    
    Patch-Name: CVE-2014-9030.diff
---
 xen/arch/x86/mm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 522c43d..05eac5f 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3638,6 +3638,12 @@ long do_mmu_update(
                 break;
             }
 
+            if ( unlikely(paging_mode_translate(pg_owner)) )
+            {
+                rc = -EINVAL;
+                break;
+            }
+
             mfn = req.ptr >> PAGE_SHIFT;
             gpfn = req.val;
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-xen/xen.git