Commit 239af7c7 authored by Juergen Gross's avatar Juergen Gross Committed by David Vrabel

x86/xen: avoid writing to freed memory after race in p2m handling

In case a race was detected during allocation of a new p2m tree
element in alloc_p2m() the new allocated mid_mfn page is freed without
updating the pointer to the found value in the tree. This will result
in overwriting the just freed page with the mfn of the p2m leaf.
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
parent fd8b7951
...@@ -566,6 +566,7 @@ static bool alloc_p2m(unsigned long pfn) ...@@ -566,6 +566,7 @@ static bool alloc_p2m(unsigned long pfn)
/* Separately check the mid mfn level */ /* Separately check the mid mfn level */
unsigned long missing_mfn; unsigned long missing_mfn;
unsigned long mid_mfn_mfn; unsigned long mid_mfn_mfn;
unsigned long old_mfn;
mid_mfn = alloc_p2m_page(); mid_mfn = alloc_p2m_page();
if (!mid_mfn) if (!mid_mfn)
...@@ -575,10 +576,13 @@ static bool alloc_p2m(unsigned long pfn) ...@@ -575,10 +576,13 @@ static bool alloc_p2m(unsigned long pfn)
missing_mfn = virt_to_mfn(p2m_mid_missing_mfn); missing_mfn = virt_to_mfn(p2m_mid_missing_mfn);
mid_mfn_mfn = virt_to_mfn(mid_mfn); mid_mfn_mfn = virt_to_mfn(mid_mfn);
if (cmpxchg(top_mfn_p, missing_mfn, mid_mfn_mfn) != missing_mfn) old_mfn = cmpxchg(top_mfn_p, missing_mfn, mid_mfn_mfn);
if (old_mfn != missing_mfn) {
free_p2m_page(mid_mfn); free_p2m_page(mid_mfn);
else mid_mfn = mfn_to_virt(old_mfn);
} else {
p2m_top_mfn_p[topidx] = mid_mfn; p2m_top_mfn_p[topidx] = mid_mfn;
}
} }
if (p2m_top[topidx][mididx] == p2m_identity || if (p2m_top[topidx][mididx] == p2m_identity ||
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment