[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86/mm: Remove cascade damage from "fishy" ref/typecount failure
- To: Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
- Date: Tue, 19 Jan 2021 11:34:44 +0000
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rp9GOsTaz2hKd3Qf9mwd9V1231b+ECmismNn+sx425o=; b=b+Ys97LiXWPGHtIb3AO6FyAae6dMXx05Tk4q93ZtbnjtN0PbfdIYa7kdRjKOOU5j/kDSan+mVHsj0qYRvoUZwt1M69lXXftPudgAe04MaY08FqRhz6nlgu352dsoHXT1F2t1QKVItRKkDZdjemsfeuPHjypMVPC3+rLjCtMOFPV1DxWzPUUd3rmXRLO9T+hthaQCH7tbA7c5yB/aIpCKzITLruhfPOBbupFZhis+zPNsasw+6z+IWWy1H2rCGyY3BGv3A7GsJ1i8PT7b+R02NvWx6A35NINCb4AVYUu1JIIgF8oebQnZALdaGHO4wunUyBrCpENnKmSacgoOYPKxFA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NI1Ocv8h4+OUZg32GpNXgITg2DP0ta/GfIURBmmR5eABau5q+4XOGe7TYzLcPu6kaADdZuv59CjU6OXp7uqi/Nb0oPrO26q0vJo0OGAwB0jNo1p5UKXBHUSSgRz17U04drsRoYUKLE5hjQZxHXBkKcsKbzaAHrenU0Fb8qCUEr7XJ67XjOElLcmYaDBSYQn/iABNtZmHaQ193o4KkfNsnJuLmMPMvkqNzsIycMAiCqwZbodCjhC2Y+aNPiasvrslSDMn55vv6GuVlRm9iuRJBXhzVNkOfrZkaL09fvO45VkilsBqWUgcRdXJXTlJ/iCSko1RjVhMut+/c4sq0D3s/w==
- Authentication-results: esa1.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
- Cc: Jan Beulich <JBeulich@xxxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Paul Durrant <paul@xxxxxxx>, Tamas K Lengyel <tamas@xxxxxxxxxxxxx>
- Delivery-date: Tue, 19 Jan 2021 11:34:58 +0000
- Ironport-sdr: Hs359wYEyyABCrUMdob4bAkQ2ie/542qpTMbGi2l0MKVmY8EP1uCH3cW6guMU6HoZIDAsNRS7H g/GzeITOBUHkRWalLlpPU+v0OM8q0PDMeYxvmvryxjzNsYyKfJZ0/climNqu1XQWkxWaYumSMf EitcQh5b45qjLy8QQNwaNs0JUI9ySdiEgesTw9ptec72nwsspQJlA9V+6qMYXyHa8KMxguqQwi 8KN5eGiieS8N7jmGaNC++JDVjLowpbs9CjFB/aC55ciwuktek9yWtMF9dmVgLVGQLBb1N12cet KAU=
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 19/01/2021 09:41, Andrew Cooper wrote:
> This code has been copied in 3 places, but it is broken and dangerous.
>
> For all these cases, the domain destruction path will underflow the whichever
> reference failed to be taken, leading to all kinds of more fun bugs.
>
> Crashing instantly is strictly less-bad behaviour.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> ---
> CC: Jan Beulich <JBeulich@xxxxxxxx>
> CC: Roger Pau Monné <roger.pau@xxxxxxxxxx>
> CC: Wei Liu <wl@xxxxxxx>
> CC: Paul Durrant <paul@xxxxxxx>
> CC: Tamas K Lengyel <tamas@xxxxxxxxxxxxx>
>
> I'm pretty certain that underflowing the main refcount is a BUG() elsewhere.
> I'm not certain what underflowing the typecount manages to do.
Actually, they're both BUG() conditions.
The typeref BUG() is in _put_page_type(), while the main refcount is
caught in put_page_alloc_ref() for each of these examples.
I'll reword the commit message, but the code change is good.
~Andrew
|
