ia64/xen-unstable

changeset 9877:4e909143218c

Add bounds check to get_mfn_from_gpfn().
From: Jan Beulich
Signed-off-by: Keir Fraser <keir@xensource.com>
author kaf24@firebug.cl.cam.ac.uk
date Thu Apr 27 14:13:42 2006 +0100 (2006-04-27)
parents 15788ab9fce2
children ef0a56c0784d
files xen/include/asm-x86/mm.h
line diff
     1.1 --- a/xen/include/asm-x86/mm.h	Thu Apr 27 14:06:41 2006 +0100
     1.2 +++ b/xen/include/asm-x86/mm.h	Thu Apr 27 14:13:42 2006 +0100
     1.3 @@ -274,6 +274,8 @@ int check_descriptor(struct desc_struct 
     1.4   * been used by the read-only MPT map.
     1.5   */
     1.6  #define phys_to_machine_mapping ((unsigned long *)RO_MPT_VIRT_START)
     1.7 +#define NR_P2M_TABLE_ENTRIES    ((unsigned long *)RO_MPT_VIRT_END \
     1.8 +                                 - phys_to_machine_mapping)
     1.9  #define INVALID_MFN             (~0UL)
    1.10  #define VALID_MFN(_mfn)         (!((_mfn) & (1U<<31)))
    1.11  
    1.12 @@ -282,7 +284,9 @@ static inline unsigned long get_mfn_from
    1.13  {
    1.14      unsigned long mfn;
    1.15  
    1.16 -    if ( __copy_from_user(&mfn, &phys_to_machine_mapping[pfn], sizeof(mfn)) )
    1.17 +    if ( unlikely(pfn >= NR_P2M_TABLE_ENTRIES) ||
    1.18 +         unlikely(__copy_from_user(&mfn, &phys_to_machine_mapping[pfn],
    1.19 +                                   sizeof(mfn))) )
    1.20  	mfn = INVALID_MFN;
    1.21  
    1.22      return mfn;