[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen stable-4.7] x86: don't allow page_unlock() to drop the last type reference
commit 1d01ddc4ef0ee363d644bb1365fffe8d899410f4 Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Thu Oct 12 15:29:21 2017 +0200 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Thu Oct 12 15:29:21 2017 +0200 x86: don't allow page_unlock() to drop the last type reference Only _put_page_type() does the necessary cleanup, and hence not all domain pages can be released during guest cleanup (leaving around zombie domains) if we get this wrong. This is XSA-242. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> master commit: 6410733a8a0dff2fe581338ff631670cf91889db master date: 2017-10-12 14:49:46 +0200 --- xen/arch/x86/mm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 38ac0d1..0e22ed5 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -1896,7 +1896,11 @@ void page_unlock(struct page_info *page) do { x = y; + ASSERT((x & PGT_count_mask) && (x & PGT_locked)); + nx = x - (1 | PGT_locked); + /* We must not drop the last reference here. */ + ASSERT(nx & PGT_count_mask); } while ( (y = cmpxchg(&page->u.inuse.type_info, x, nx)) != x ); } @@ -2577,6 +2581,17 @@ static int _put_page_type(struct page_info *page, bool_t preemptible, (page->count_info & PGC_page_table)) ) page_set_tlbflush_timestamp(page); } + else if ( unlikely((nx & (PGT_locked | PGT_count_mask)) == + (PGT_locked | 1)) ) + { + /* + * We must not drop the second to last reference when the page is + * locked, as page_unlock() doesn't do any cleanup of the type. + */ + cpu_relax(); + y = page->u.inuse.type_info; + continue; + } if ( likely((y = cmpxchg(&page->u.inuse.type_info, x, nx)) == x) ) break; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.7 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx https://lists.xenproject.org/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |