[Xen-changelog] [xen master] arm: p2m.c bug-fix: hypervisor hang on __p2m_get_mem_access

[patchbot@xxxxxxx]

commit 6b1c74abc90273efaa749022bd5367330d20aab6
Author:     Corneliu ZUZU <czuzu@xxxxxxxxxxxxxxx>
AuthorDate: Wed Jan 27 14:24:35 2016 +0200
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Wed Feb 3 11:20:07 2016 +0000

    arm: p2m.c bug-fix: hypervisor hang on __p2m_get_mem_access
    
    When __p2m_get_mem_access gets called, the p2m lock is already taken
    by either get_page_from_gva or p2m_get_mem_access.
    
    Possible code paths:
    1)  -> get_page_from_gva
                -> p2m_mem_access_check_and_get_page
                        -> __p2m_get_mem_access
    2)  -> p2m_get_mem_access
                -> __p2m_get_mem_access
    
    In both cases if __p2m_get_mem_access subsequently gets to
    call p2m_lookup (happens if !radix_tree_lookup(...)), a hypervisor
    hang will occur, since p2m_lookup also spin-locks on the p2m lock.
    
    This bug-fix simply replaces the p2m_lookup call from __p2m_get_mem_access
    with a call to __p2m_lookup.
    
    Following Ian's suggestion, we also add an ASSERT to ensure that
    the p2m lock is taken upon __p2m_get_mem_access entry.
    
    Signed-off-by: Corneliu ZUZU <czuzu@xxxxxxxxxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 xen/arch/arm/p2m.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index 2190908..e8e6db4 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -468,6 +468,8 @@ static int __p2m_get_mem_access(struct domain *d, gfn_t gfn,
 #undef ACCESS
     };
 
+    ASSERT(spin_is_locked(&p2m->lock));
+
     /* If no setting was ever set, just return rwx. */
     if ( !p2m->mem_access_enabled )
     {
@@ -490,7 +492,7 @@ static int __p2m_get_mem_access(struct domain *d, gfn_t gfn,
          * No setting was found in the Radix tree. Check if the
          * entry exists in the page-tables.
          */
-        paddr_t maddr = p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL);
+        paddr_t maddr = __p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL);
         if ( INVALID_PADDR == maddr )
             return -ESRCH;
 
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog