Re: [Xen-devel] [PATCH 4/9] kexec: extend hypercall with improved load/unload ops

[Don Slutz <dslutz@xxxxxxxxxxx>]

On 10/08/13 12:55, David Vrabel wrote:
> From: David Vrabel <david.vrabel@xxxxxxxxxx>
[...]
> +
> +static int kexec_segments_from_ind_page(unsigned long mfn,
> +                                        unsigned *nr_segments,
> +                                        xen_kexec_segment_t *segments,
> +                                        bool_t compat)
> +{
> +    void *page;
> +    kimage_entry_t *entry;
> +    int ret = 0;
> +
> +    page = map_domain_page(mfn);
> +
> +    /*
> +     * Walk the indirection page list, adding destination pages to the
> +     * segments.
> +     */
> +    for ( entry = page; ; )
>       {
> -        if ( test_and_clear_bit((base + pos), &kexec_flags) )
> +        unsigned long ind;
> +
> +        ind = kimage_entry_ind(entry, compat);
> +        mfn = kimage_entry_mfn(entry, compat);
> +
> +        switch ( ind )
>           {
> -            image = &kexec_image[base + pos];
> -            machine_kexec_unload(load->type, base + pos, image);
> +        case IND_DESTINATION:
> +            ret = kexec_segments_add_segment(nr_segments, segments, mfn);
> +            if ( ret < 0 )
> +                goto done;
> +            break;
> +        case IND_INDIRECTION:
> +            unmap_domain_page(page);
> +            page = map_domain_page(mfn);
> +            if ( page == NULL )
> +                return -ENOMEM;
> +            entry = page;
> +            continue;
> +        case IND_DONE:
> +            goto done;
> +        case IND_SOURCE:
> +            segments[*nr_segments-1].dest_size += PAGE_SIZE;
I have not been able to prove that *nr_segments can not be zero when you get 
here.  So I think that this needs to be checked for instead of corrupting 
memory.
> +            break;
> +        default:
> +            ret = -EINVAL;
> +            goto done;
>           }
> +        entry = kimage_entry_next(entry, compat);
>       }
> +done:
> +    unmap_domain_page(page);
> +    return ret;
> +}
[...]
>
   -Don Slutz

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel