[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [PATCHv3] xen/p2m: check MFN is in range before using the m2p table
On Fri, 13 Sep 2013, David Vrabel wrote: > From: David Vrabel <david.vrabel@xxxxxxxxxx> > > On hosts with more than 168 GB of memory, a 32-bit guest may attempt > to grant map an MFN that is not cannot lookup in its mapping of the ^error > m2p table. There is an m2p lookup as part of m2p_add_override() and > m2p_remove_override(). The lookup falls off the end of the mapped > portion of the m2p and (because the mapping is at the highest virtual > address) wraps around and the lookup causes a fault on what appears to > be a user space address. > > do_page_fault() (thinking it's a fault to a userspace address), tries > to lock mm->mmap_sem. If the gntdev device is used for the grant map, > m2p_add_override() is called from from gnttab_mmap() with mm->mmap_sem > already locked. do_page_fault() then deadlocks. > > The deadlock would most commonly occur when a 64-bit guest is started > and xenconsoled attempts to grant map its console ring. > > Introduce mfn_to_pfn_no_overrides() which checks the MFN is within the > mapped portion of the m2p table before accessing the table and use > this in m2p_add_override(), m2p_remove_override(), and mfn_to_pfn() > (which already had the correct range check). > > All faults caused by accessing the non-existant parts of the m2p are > thus within the kernel address space and exception_fixup() is called > without trying to lock mm->mmap_sem. > > This means that for MFNs that are outside the mapped range of the m2p > then mfn_to_pfn() will always look in the m2p overrides. This is > correct because it must be a foreign MFN (and the PFN in the m2p in > this case is only relevant for the other domain). > > Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx> > Cc: Stefano Stabellini <stefano.stabellini@xxxxxxxxxx> > Cc: Jan Beulich <JBeulich@xxxxxxxx> Aside from the typo: Acked-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> > v3: check for auto_translated_physmap in mfn_to_pfn_no_overrides() > v2: in mfn_to_pfn() look in m2p_overrides if the MFN is out of > range as it's probably foreign. > --- > arch/x86/include/asm/xen/page.h | 31 ++++++++++++++++++++----------- > arch/x86/xen/p2m.c | 10 ++++------ > 2 files changed, 24 insertions(+), 17 deletions(-) > > diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h > index 6aef9fb..b913915 100644 > --- a/arch/x86/include/asm/xen/page.h > +++ b/arch/x86/include/asm/xen/page.h > @@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned > long pfn) > return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY; > } > > -static inline unsigned long mfn_to_pfn(unsigned long mfn) > +static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn) > { > unsigned long pfn; > - int ret = 0; > + int ret; > > if (xen_feature(XENFEAT_auto_translated_physmap)) > return mfn; > > - if (unlikely(mfn >= machine_to_phys_nr)) { > - pfn = ~0; > - goto try_override; > - } > - pfn = 0; > + if (unlikely(mfn >= machine_to_phys_nr)) > + return ~0; > + > /* > * The array access can fail (e.g., device space beyond end of RAM). > * In such cases it doesn't matter what we return (we return garbage), > * but we must handle the fault without crashing! > */ > ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); > -try_override: > - /* ret might be < 0 if there are no entries in the m2p for mfn */ > if (ret < 0) > - pfn = ~0; > - else if (get_phys_to_machine(pfn) != mfn) > + return ~0; > + > + return pfn; > +} > + > +static inline unsigned long mfn_to_pfn(unsigned long mfn) > +{ > + unsigned long pfn; > + > + if (xen_feature(XENFEAT_auto_translated_physmap)) > + return mfn; > + > + pfn = mfn_to_pfn_no_overrides(mfn); > + if (get_phys_to_machine(pfn) != mfn) { > /* > * If this appears to be a foreign mfn (because the pfn > * doesn't map back to the mfn), then check the local override > @@ -111,6 +119,7 @@ try_override: > * m2p_find_override_pfn returns ~0 if it doesn't find anything. > */ > pfn = m2p_find_override_pfn(mfn, ~0); > + } > > /* > * pfn is ~0 if there are no entries in the m2p for mfn or if the > diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c > index 8b901e8..a61c7d5 100644 > --- a/arch/x86/xen/p2m.c > +++ b/arch/x86/xen/p2m.c > @@ -879,7 +879,6 @@ int m2p_add_override(unsigned long mfn, struct page *page, > unsigned long uninitialized_var(address); > unsigned level; > pte_t *ptep = NULL; > - int ret = 0; > > pfn = page_to_pfn(page); > if (!PageHighMem(page)) { > @@ -926,8 +925,8 @@ int m2p_add_override(unsigned long mfn, struct page *page, > * frontend pages while they are being shared with the backend, > * because mfn_to_pfn (that ends up being called by GUPF) will > * return the backend pfn rather than the frontend pfn. */ > - ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); > - if (ret == 0 && get_phys_to_machine(pfn) == mfn) > + pfn = mfn_to_pfn_no_overrides(mfn); > + if (get_phys_to_machine(pfn) == mfn) > set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)); > > return 0; > @@ -942,7 +941,6 @@ int m2p_remove_override(struct page *page, > unsigned long uninitialized_var(address); > unsigned level; > pte_t *ptep = NULL; > - int ret = 0; > > pfn = page_to_pfn(page); > mfn = get_phys_to_machine(pfn); > @@ -1029,8 +1027,8 @@ int m2p_remove_override(struct page *page, > * the original pfn causes mfn_to_pfn(mfn) to return the frontend > * pfn again. */ > mfn &= ~FOREIGN_FRAME_BIT; > - ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); > - if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) && > + pfn = mfn_to_pfn_no_overrides(mfn); > + if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) && > m2p_find_override(mfn) == NULL) > set_phys_to_machine(pfn, mfn); > > -- > 1.7.2.5 > _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |