[Xen-devel] [PATCH for-4.9] x86/mm: Mark pages as dirty after (rather than before) writing to them

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

Otherwise a logdirty client can race with observing the page becoming dirty,
and copy the frame before the write is complete and end up with a stale
version.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Julien Grall <julien.grall@xxxxxxx>
---
 xen/arch/x86/mm.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 77b0af1..97c3cb8 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3556,11 +3556,10 @@ long do_mmuext_op(
                 break;
             }
 
-            /* A page is dirtied when it's being cleared. */
-            paging_mark_dirty(pg_owner, _mfn(page_to_mfn(page)));
-
             clear_domain_page(_mfn(page_to_mfn(page)));
 
+            paging_mark_dirty(pg_owner, _mfn(page_to_mfn(page)));
+
             put_page_and_type(page);
             break;
         }
@@ -3594,12 +3593,11 @@ long do_mmuext_op(
                 break;
             }
 
-            /* A page is dirtied when it's being copied to. */
-            paging_mark_dirty(pg_owner, _mfn(page_to_mfn(dst_page)));
-
             copy_domain_page(_mfn(page_to_mfn(dst_page)),
                              _mfn(page_to_mfn(src_page)));
 
+            paging_mark_dirty(pg_owner, _mfn(page_to_mfn(dst_page)));
+
             put_page_and_type(dst_page);
             put_page(src_page);
             break;
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel