]> rtime.felk.cvut.cz Git - jailhouse.git/commit
driver: fix unsigned long overflow in leave_hypervisor
authorAntonios Motakis <antonios.motakis@huawei.com>
Thu, 28 Apr 2016 14:01:29 +0000 (16:01 +0200)
committerJan Kiszka <jan.kiszka@siemens.com>
Thu, 28 Apr 2016 15:18:46 +0000 (17:18 +0200)
commitd2219890eabe7e9132912e45b2c3f3bbea9512fa
tree76f38bbf784897d53dc2f367658d8c2c2379c5c6
parent4a3317bb021881a1f8e96f4b7e3ba5c0be3ea70c
driver: fix unsigned long overflow in leave_hypervisor

When shutting down the hypervisor, in the leave_hypervisor
function, the Linux driver touches every hypervisor page, to
ensure all pages are mapped. However, the current implementation
assumes hv_core_and_percpu_size is aligned to PAGE_SIZE. This may
not be the case, if PAGE_SIZE is different on the hypervisor side.

This can cause an unsigned long overflow, leading to an infinite
loop of touching successive pages starting from hypervisor_mem.
The loop will be broken as soon as Linux tries to touch an invalid
page, leading to a kernel crash.

Signed-off-by: Antonios Motakis <antonios.motakis@huawei.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/main.c