aboutsummaryrefslogtreecommitdiff
path: root/drivers/lguest
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/lguest')
-rw-r--r--drivers/lguest/core.c15
-rw-r--r--drivers/lguest/lguest_user.c15
-rw-r--r--drivers/lguest/page_tables.c2
3 files changed, 22 insertions, 10 deletions
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 7743d73768d..c632c08cbbd 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -69,11 +69,22 @@ static __init int map_switcher(void)
switcher_page[i] = virt_to_page(addr);
}
+ /* First we check that the Switcher won't overlap the fixmap area at
+ * the top of memory. It's currently nowhere near, but it could have
+ * very strange effects if it ever happened. */
+ if (SWITCHER_ADDR + (TOTAL_SWITCHER_PAGES+1)*PAGE_SIZE > FIXADDR_START){
+ err = -ENOMEM;
+ printk("lguest: mapping switcher would thwack fixmap\n");
+ goto free_pages;
+ }
+
/* Now we reserve the "virtual memory area" we want: 0xFFC00000
* (SWITCHER_ADDR). We might not get it in theory, but in practice
- * it's worked so far. */
+ * it's worked so far. The end address needs +1 because __get_vm_area
+ * allocates an extra guard page, so we need space for that. */
switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- VM_ALLOC, SWITCHER_ADDR, VMALLOC_END);
+ VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
if (!switcher_vma) {
err = -ENOMEM;
printk("lguest: could not map switcher pages high\n");
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 85d42d3d01a..2221485b077 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -241,15 +241,16 @@ static ssize_t write(struct file *file, const char __user *in,
cpu = &lg->cpus[cpu_id];
if (!cpu)
return -EINVAL;
- }
- /* Once the Guest is dead, all you can do is read() why it died. */
- if (lg && lg->dead)
- return -ENOENT;
+ /* Once the Guest is dead, you can only read() why it died. */
+ if (lg->dead)
+ return -ENOENT;
- /* If you're not the task which owns the Guest, you can only break */
- if (lg && current != cpu->tsk && req != LHREQ_BREAK)
- return -EPERM;
+ /* If you're not the task which owns the Guest, all you can do
+ * is break the Launcher out of running the Guest. */
+ if (current != cpu->tsk && req != LHREQ_BREAK)
+ return -EPERM;
+ }
switch (req) {
case LHREQ_INITIALIZE:
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 275f23c2deb..a7f64a9d67e 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -391,7 +391,7 @@ static unsigned int find_pgdir(struct lguest *lg, unsigned long pgtable)
{
unsigned int i;
for (i = 0; i < ARRAY_SIZE(lg->pgdirs); i++)
- if (lg->pgdirs[i].gpgdir == pgtable)
+ if (lg->pgdirs[i].pgdir && lg->pgdirs[i].gpgdir == pgtable)
break;
return i;
}