[Xen-devel] [PATCH V4] xen/balloon: flush persistent kmaps in correct position

[Wei Liu <wei.liu2@xxxxxxxxxx>]

Xen balloon driver will update ballooned out pages' P2M entries to point
to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc
page while non-preemptible", kmap_flush_unused was moved after updating
P2M table. In that case for 32 bit PV guest we might end up with

  P2M    X -----> S  (S is mfn of balloon scratch page)
  M2P    Y -----> X  (Y is mfn in persistent kmap entry)

kmap_flush_unused() iterates through all the PTEs in the kmap address
space, using pte_to_page() to obtain the page. If the p2m and the m2p
are inconsistent the incorrect page is returned. This will clear
page->address on the wrong page which may cause subsequent oopses if
that page is currently kmap'ed.

Move the flush back between get_page and all other operations that look
into p2m and m2p to fix this.

Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
Cc: David Vrabel <david.vrabel@xxxxxxxxxx>
Cc: Konrad Wilk <konrad.wilk@xxxxxxxxxx>
Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx # 3.12+
---
 drivers/xen/balloon.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 37d06ea..52a18bf 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -402,9 +402,16 @@ static enum bp_state decrease_reservation(unsigned long 
nr_pages, gfp_t gfp)
 
                pfn = page_to_pfn(page);
                frame_list[i] = pfn_to_mfn(pfn);
+       }
 
-               scrub_page(page);
+       /* Ensure that ballooned highmem pages don't have kmaps. */
+       kmap_flush_unused();
+       flush_tlb_all();
 
+       for (i = 0; i < nr_pages; i++) {
+               pfn = mfn_to_pfn(frame_list[i]);
+               page = pfn_to_page(pfn);
+               scrub_page(page);
 #ifdef CONFIG_XEN_HAVE_PVMMU
                /*
                 * Ballooned out frames are effectively replaced with
@@ -432,10 +439,6 @@ static enum bp_state decrease_reservation(unsigned long 
nr_pages, gfp_t gfp)
                balloon_append(pfn_to_page(pfn));
        }
 
-       /* Ensure that ballooned highmem pages don't have kmaps. */
-       kmap_flush_unused();
-       flush_tlb_all();
-
        set_xen_guest_handle(reservation.extent_start, frame_list);
        reservation.nr_extents   = nr_pages;
        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel