[Xen-changelog] [xen stable-4.6] x86: discard type information when stealing pages

[patchbot@xxxxxxx]

commit dcef1655273d2ea28c96caf4103005b1ad5fa590
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue May 2 15:02:02 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue May 2 15:02:02 2017 +0200

    x86: discard type information when stealing pages
    
    While a page having just a single general reference left necessarily
    has a zero type reference count too, its type may still be valid (and
    in validated state; at present this is only possible and relevant for
    PGT_seg_desc_page, as page tables have their type forcibly zapped when
    their type reference count drops to zero, and
    PGT_{writable,shared}_page pages don't require any validation). In
    such a case when the page is being re-used with the same type again,
    validation is being skipped. As validation criteria differ between
    32- and 64-bit guests, pages to be transferred between guests need to
    have their validation indicator zapped (and with it we zap all other
    type information at once).
    
    This is XSA-214.
    
    Reported-by: Jann Horn <jannh@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: eaf537342c909875c10f49b06e17493655410681
    master date: 2017-05-02 14:46:58 +0200
---
 xen/arch/x86/mm.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 64e2de3..24dfda4 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4334,6 +4334,17 @@ int steal_page(
         y = cmpxchg(&page->count_info, x, x & ~PGC_count_mask);
     } while ( y != x );
 
+    /*
+     * With the sole reference dropped temporarily, no-one can update type
+     * information. Type count also needs to be zero in this case, but e.g.
+     * PGT_seg_desc_page may still have PGT_validated set, which we need to
+     * clear before transferring ownership (as validation criteria vary
+     * depending on domain type).
+     */
+    BUG_ON(page->u.inuse.type_info & (PGT_count_mask | PGT_locked |
+                                      PGT_pinned));
+    page->u.inuse.type_info = 0;
+
     /* Swizzle the owner then reinstate the PGC_allocated reference. */
     page_set_owner(page, NULL);
     y = page->count_info;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog