[Xen-changelog] [xen-unstable] xen/arm: create_p2m_entries should not call free_domheap_page

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
# Date 1349791534 -3600
# Node ID f91b841ff95caaaf0cb8f333f5a95f7b562cab76
# Parent  b98da9b014141929a02a2ea679bf7f5c6edcf7f4
xen/arm: create_p2m_entries should not call free_domheap_page

The guest is entitled to leak a page from its p2m (by overwriting it) if
it wants to. Since the memory is effectively lost to it (can't even be
recovered by XENMEM increase reservation etc).

In these cases we shouldn't call free_domheap_page to free the existing
page from create_p2m_entries, because it resets the reference counting
but the page is still allocated to the guest (even if not in the p2m
anymore) and common grant_table code is also going to call put_page on
it.

Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Committed-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---


diff -r b98da9b01414 -r f91b841ff95c xen/arch/arm/p2m.c
--- a/xen/arch/arm/p2m.c        Tue Oct 09 15:05:33 2012 +0100
+++ b/xen/arch/arm/p2m.c        Tue Oct 09 15:05:34 2012 +0100
@@ -189,12 +189,7 @@ static int create_p2m_entries(struct dom
         /* else: third already valid */
 
         if ( third[third_table_offset(addr)].p2m.valid )
-        {
-            /* p2m entry already present */
-            free_domheap_page(
-                    mfn_to_page(third[third_table_offset(addr)].p2m.base));
             flush_tlb_all_local();
-        }
 
         /* Allocate a new RAM page and attach */
         switch (op) {

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog