← Back to branch summary

~ubuntu-branches/ubuntu/precise/xen/precise-security

« back to all changes in this revision

Viewing changes to xen/arch/x86/x86_64/compat/mm.c

  • Committer: Package Import Robot
  • Author(s): Stefan Bader
  • Date: 2013-06-06 16:06:34 UTC
  • Revision ID: package-import@ubuntu.com-20130606160634-wqqowry2ghhfx4fl
Tags: 4.1.2-2ubuntu2.9
* Applying Xen Security Advisories:
  - CVE-2013-1918 / XSA-45
    * x86: make vcpu_destroy_pagetables() preemptible
    * x86: make new_guest_cr3() preemptible
    * x86: make MMUEXT_NEW_USER_BASEPTR preemptible
    * x86: make vcpu_reset() preemptible
    * x86: make arch_set_info_guest() preemptible
    * x86: make page table unpinning preemptible
    * x86: make page table handling error paths preemptible
  - CVE-2013-1952 / XSA-49
    * VT-d: don't permit SVT_NO_VERIFY entries for known device types
  - CVE-2013-1964 / XSA-50
    * Fix rcu domain locking for transitive grants
  - CVE-2013-2076 / XSA-52
    * x86/xsave: fix information leak on AMD CPUs
  - CVE-2013-2077 / XSA-53
    * x86/xsave: recover from faults on XRSTOR
  - CVE-2013-2078 / XSA-54
    * x86/xsave: properly check guest input to XSETBV
  - CVE-2013-2072 / XSA-56
    * libxc: limit cpu values when setting vcpu affinity

Show diffs side-by-side

added added

removed removed

Lines of Context:
xen/arch/x86/x86_64/compat/mm.c
218
218
    int rc = 0;
219
219
    XEN_GUEST_HANDLE(mmuext_op_t) nat_ops;
220
220
 
 
221
    if ( unlikely(count == MMU_UPDATE_PREEMPTED) &&
 
222
         likely(guest_handle_is_null(cmp_uops)) )
 
223
    {
 
224
        set_xen_guest_handle(nat_ops, NULL);
 
225
        return do_mmuext_op(nat_ops, count, pdone, foreigndom);
 
226
    }
 
227
 
221
228
    preempt_mask = count & MMU_UPDATE_PREEMPTED;
222
229
    count ^= preempt_mask;
223
230
 
315
322
                                    : mcs->call.args[1];
316
323
                unsigned int left = arg1 & ~MMU_UPDATE_PREEMPTED;
317
324
 
318
 
                BUG_ON(left == arg1);
 
325
                BUG_ON(left == arg1 && left != i);
319
326
                BUG_ON(left > count);
320
327
                guest_handle_add_offset(nat_ops, i - left);
321
328
                guest_handle_subtract_offset(cmp_uops, left);
322
329
                left = 1;
323
 
                BUG_ON(!hypercall_xlat_continuation(&left, 0x01, nat_ops, cmp_uops));
 
330
                if ( arg1 != MMU_UPDATE_PREEMPTED )
 
331
                {
 
332
                    BUG_ON(!hypercall_xlat_continuation(&left, 0x01, nat_ops,
 
333
                                                        cmp_uops));
 
334
                    if ( !test_bit(_MCSF_in_multicall, &mcs->flags) )
 
335
                        regs->_ecx += count - i;
 
336
                    else
 
337
                        mcs->compat_call.args[1] += count - i;
 
338
                }
 
339
                else
 
340
                    BUG_ON(hypercall_xlat_continuation(&left, 0));
324
341
                BUG_ON(left != arg1);
325
 
                if (!test_bit(_MCSF_in_multicall, &mcs->flags))
326
 
                    regs->_ecx += count - i;
327
 
                else
328
 
                    mcs->compat_call.args[1] += count - i;
329
342
            }
330
343
            else
331
344
                BUG_ON(err > 0);