From: Julien Grall <julien.grall@linaro.org>
To: xen-devel@lists.xenproject.org
Cc: stefano.stabellini@citrix.com,
Julien Grall <julien.grall@linaro.org>,
tim@xen.org, ian.campbell@citrix.com, george.dunlap@citrix.com
Subject: [PATCH] xen/arm: Correctly handle non-page aligned pointer in raw_copy_*
Date: Fri, 14 Feb 2014 17:10:09 +0000 [thread overview]
Message-ID: <1392397809-13255-1-git-send-email-julien.grall@linaro.org> (raw)
The current implementation of raw_copy_* helpers may lead to data corruption
and sometimes Xen crash when the guest virtual address is not aligned to
PAGE_SIZE.
When the total length is higher than a page, the length to read is badly
compute with
min(len, (unsigned)(PAGE_SIZE - offset))
As the offset is only computed one time per function, if the start address was
not aligned to PAGE_SIZE, we can end up in same iteration:
- to read accross page boundary => xen crash
- read the previous page => data corruption
This issue can be resolved by computing the offset on every iteration.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
---
This patch is a bug fix for Xen 4.4. Without this patch the data may be
corrupted between Xen and the guest when the guest virtual address is
not aligned to PAGE_SIZE. Sometimes it can also crash Xen.
These functions are used in numerous place in Xen. If it introduce another
bug we can see quickly with small amount of data.
---
xen/arch/arm/guestcopy.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c
index af0af6b..b3b54e9 100644
--- a/xen/arch/arm/guestcopy.c
+++ b/xen/arch/arm/guestcopy.c
@@ -9,12 +9,11 @@ static unsigned long raw_copy_to_guest_helper(void *to, const void *from,
unsigned len, int flush_dcache)
{
/* XXX needs to handle faults */
- unsigned offset = (vaddr_t)to & ~PAGE_MASK;
-
while ( len )
{
paddr_t g;
void *p;
+ unsigned offset = (vaddr_t)to & ~PAGE_MASK;
unsigned size = min(len, (unsigned)PAGE_SIZE - offset);
if ( gvirt_to_maddr((vaddr_t) to, &g) )
@@ -50,12 +49,12 @@ unsigned long raw_copy_to_guest_flush_dcache(void *to, const void *from,
unsigned long raw_clear_guest(void *to, unsigned len)
{
/* XXX needs to handle faults */
- unsigned offset = (vaddr_t)to & ~PAGE_MASK;
while ( len )
{
paddr_t g;
void *p;
+ unsigned offset = (vaddr_t)to & ~PAGE_MASK;
unsigned size = min(len, (unsigned)PAGE_SIZE - offset);
if ( gvirt_to_maddr((vaddr_t) to, &g) )
@@ -76,12 +75,11 @@ unsigned long raw_clear_guest(void *to, unsigned len)
unsigned long raw_copy_from_guest(void *to, const void __user *from, unsigned len)
{
- unsigned offset = (vaddr_t)from & ~PAGE_MASK;
-
while ( len )
{
paddr_t g;
void *p;
+ unsigned offset = (vaddr_t)from & ~PAGE_MASK;
unsigned size = min(len, (unsigned)(PAGE_SIZE - offset));
if ( gvirt_to_maddr((vaddr_t) from & PAGE_MASK, &g) )
--
1.7.10.4
next reply other threads:[~2014-02-14 17:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-14 17:10 Julien Grall [this message]
2014-02-14 17:35 ` [PATCH] xen/arm: Correctly handle non-page aligned pointer in raw_copy_* Stefano Stabellini
2014-02-18 14:59 ` Ian Campbell
2014-02-18 15:00 ` Ian Campbell
2014-02-18 15:08 ` Julien Grall
2014-02-18 15:25 ` Ian Campbell
2014-02-18 15:29 ` Julien Grall
2014-02-18 15:05 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1392397809-13255-1-git-send-email-julien.grall@linaro.org \
--to=julien.grall@linaro.org \
--cc=george.dunlap@citrix.com \
--cc=ian.campbell@citrix.com \
--cc=stefano.stabellini@citrix.com \
--cc=tim@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.