From: Tony Breeds <tony@bakeyournoodle.com>
Subject: [PATCH] Fix user direct access in grant_table.c
Date: Tue, 13 Dec 2005 16:54:33 +1100
Message-ID: <20051213055433.GW25348@bakeyournoodle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Xen-Devel <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

From: Rusty Russell <rusty@rustcorp.com.au>

Tony found a direct userspace access with his unit test for
grant_table.c.  We access "uop->frame_list" (a pointer) directly, rather
than using "op.frame_list".

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>


diff -r aebe8f5c7069 xen/common/grant_table.c
--- a/xen/common/grant_table.c	Mon Dec 12 18:45:53 2005
+++ b/xen/common/grant_table.c	Tue Dec 13 15:23:23 2005
@@ -579,7 +579,7 @@
         (void)put_user(GNTST_okay, &uop->status);
         for ( i = 0; i < op.nr_frames; i++ )
             (void)put_user(gnttab_shared_mfn(d, d->grant_table, i),
-                           &uop->frame_list[i]);
+                           &op.frame_list[i]);
     }
 
     put_domain(d);

Yours Tony

   linux.conf.au       http://linux.conf.au/ || http://lca2006.linux.org.au/
   Jan 23-28 2006      The Australian Linux Technical Conference!