]> xenbits.xensource.com Git - xen.git/commit
x86/shadow: fix UB pointer arithmetic in sh_mfn_is_a_page_table()
authorRoger Pau Monne <roger.pau@citrix.com>
Tue, 18 Mar 2025 08:20:59 +0000 (09:20 +0100)
committerRoger Pau Monne <roger.pau@citrix.com>
Thu, 20 Mar 2025 11:28:30 +0000 (12:28 +0100)
commit45ee73f1b24246f13cd9583cb2ee25fb9c782db8
tree3d4c367383a489d87e2fde54fb8f695c33064e1f
parentfc302866f42f552337ae7d8d78877aec36e6e2ff
x86/shadow: fix UB pointer arithmetic in sh_mfn_is_a_page_table()

UBSAN complains with:

UBSAN: Undefined behaviour in arch/x86/mm/shadow/private.h:515:30
pointer operation overflowed ffff82e000000000 to ffff82dfffffffe0
[...]
Xen call trace:
    [<ffff82d040303782>] R common/ubsan/ubsan.c#ubsan_epilogue+0xa/0xc0
    [<ffff82d040304bc3>] F __ubsan_handle_pointer_overflow+0xcb/0x100
    [<ffff82d040471b2d>] F arch/x86/mm/shadow/guest_2.c#sh_page_fault__guest_2+0x1e350
    [<ffff82d0403b206b>] F svm_vmexit_handler+0xdf3/0x2450
    [<ffff82d0402049c0>] F svm_stgi_label+0x5/0x15

Fix by moving the call to mfn_to_page() after the check of whether the
passed gmfn is valid.  This avoid the call to mfn_to_page() with an
INVALID_MFN parameter.

While there make the page local variable const, it's not modified by the
function.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
xen/arch/x86/mm/shadow/private.h