19d8f590f0
xen.spec - bsc#945167 - Running command ’ xl pci-assignable-add 03:10.1’ secondly show errors 55f7f9d2-libxl-slightly-refine-pci-assignable-add-remove-handling.patch - Upstream patches from Jan 55f2e438-x86-hvm-fix-saved-pmtimer-and-hpet-values.patch 55f9345b-x86-MSI-fail-if-no-hardware-support.patch 5604f239-x86-PV-properly-populate-descriptor-tables.patch 5604f2e6-vt-d-fix-IM-bit-mask-and-unmask-of-FECTL_REG.patch 560a4af9-x86-EPT-tighten-conditions-of-IOMMU-mapping-updates.patch 560a7c36-x86-p2m-pt-delay-freeing-of-intermediate-page-tables.patch 560a7c53-x86-p2m-pt-ignore-pt-share-flag-for-shadow-mode-guests.patch 560bd926-credit1-fix-tickling-when-it-happens-from-a-remote-pCPU.patch 560e6d34-x86-p2m-pt-tighten-conditions-of-IOMMU-mapping-updates.patch - bsc#941074 - VmError: Device 51728 (vbd) could not be connected. Hotplug scripts not working. hotplug-Linux-block-performance-fix.patch - bsc#947165 - VUL-0: CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142) CVE-2015-7311-xsa142.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=378
98 lines
3.7 KiB
Diff
98 lines
3.7 KiB
Diff
# Commit 960265fbd878cdc9841473b755e4ccc9eb1942d2
|
|
# Date 2015-09-29 13:55:34 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/p2m-pt: delay freeing of intermediate page tables
|
|
|
|
Old intermediate page tables must be freed only after IOMMU side
|
|
updates/flushes have got carried out.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
|
|
|
|
--- a/xen/arch/x86/mm/p2m-pt.c
|
|
+++ b/xen/arch/x86/mm/p2m-pt.c
|
|
@@ -486,8 +486,9 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
/* XXX -- this might be able to be faster iff current->domain == d */
|
|
void *table;
|
|
unsigned long i, gfn_remainder = gfn;
|
|
- l1_pgentry_t *p2m_entry;
|
|
- l1_pgentry_t entry_content;
|
|
+ l1_pgentry_t *p2m_entry, entry_content;
|
|
+ /* Intermediate table to free if we're replacing it with a superpage. */
|
|
+ l1_pgentry_t intermediate_entry = l1e_empty();
|
|
l2_pgentry_t l2e_content;
|
|
l3_pgentry_t l3e_content;
|
|
int rc;
|
|
@@ -535,7 +536,6 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
*/
|
|
if ( page_order == PAGE_ORDER_1G )
|
|
{
|
|
- l1_pgentry_t old_entry = l1e_empty();
|
|
p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
|
|
L3_PAGETABLE_SHIFT - PAGE_SHIFT,
|
|
L3_PAGETABLE_ENTRIES);
|
|
@@ -545,7 +545,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
{
|
|
/* We're replacing a non-SP page with a superpage. Make sure to
|
|
* handle freeing the table properly. */
|
|
- old_entry = *p2m_entry;
|
|
+ intermediate_entry = *p2m_entry;
|
|
}
|
|
|
|
ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
|
|
@@ -563,10 +563,6 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
|
|
p2m->write_p2m_entry(p2m, gfn, p2m_entry, entry_content, 3);
|
|
/* NB: paging_write_p2m_entry() handles tlb flushes properly */
|
|
-
|
|
- /* Free old intermediate tables if necessary */
|
|
- if ( l1e_get_flags(old_entry) & _PAGE_PRESENT )
|
|
- p2m_free_entry(p2m, &old_entry, page_order);
|
|
}
|
|
else
|
|
{
|
|
@@ -607,7 +603,6 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
}
|
|
else if ( page_order == PAGE_ORDER_2M )
|
|
{
|
|
- l1_pgentry_t old_entry = l1e_empty();
|
|
p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
|
|
L2_PAGETABLE_SHIFT - PAGE_SHIFT,
|
|
L2_PAGETABLE_ENTRIES);
|
|
@@ -619,7 +614,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
{
|
|
/* We're replacing a non-SP page with a superpage. Make sure to
|
|
* handle freeing the table properly. */
|
|
- old_entry = *p2m_entry;
|
|
+ intermediate_entry = *p2m_entry;
|
|
}
|
|
|
|
ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
|
|
@@ -640,10 +635,6 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
|
|
p2m->write_p2m_entry(p2m, gfn, p2m_entry, entry_content, 2);
|
|
/* NB: paging_write_p2m_entry() handles tlb flushes properly */
|
|
-
|
|
- /* Free old intermediate tables if necessary */
|
|
- if ( l1e_get_flags(old_entry) & _PAGE_PRESENT )
|
|
- p2m_free_entry(p2m, &old_entry, page_order);
|
|
}
|
|
|
|
/* Track the highest gfn for which we have ever had a valid mapping */
|
|
@@ -671,6 +662,14 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
|
|
}
|
|
}
|
|
|
|
+ /*
|
|
+ * Free old intermediate tables if necessary. This has to be the
|
|
+ * last thing we do, after removal from the IOMMU tables, so as to
|
|
+ * avoid a potential use-after-free.
|
|
+ */
|
|
+ if ( l1e_get_flags(intermediate_entry) & _PAGE_PRESENT )
|
|
+ p2m_free_entry(p2m, &intermediate_entry, page_order);
|
|
+
|
|
out:
|
|
unmap_domain_page(table);
|
|
return rc;
|