[Xen-changelog] [xen stable-4.10] x86/shadow: fix refcount overflow check

[patchbot@xxxxxxx]

commit 89d311bf8ffe1ce76d7362716498b18463b0ebb1
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Dec 8 15:27:14 2017 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Fri Dec 8 15:27:14 2017 +0000

    x86/shadow: fix refcount overflow check
    
    Commit c385d27079 ("x86 shadow: for multi-page shadows, explicitly track
    the first page") reduced the refcount width to 25, without adjusting the
    overflow check. Eliminate the disconnect by using a manifest constant.
    
    Interestingly, up to commit 047782fa01 ("Out-of-sync L1 shadows: OOS
    snapshot") the refcount was 27 bits wide, yet the check was already
    using 26.
    
    This is XSA-249.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: George Dunlap <george.dunlap@xxxxxxxxxx>
    Reviewed-by: Tim Deegan <tim@xxxxxxx>
---
 xen/arch/x86/mm/shadow/private.h | 2 +-
 xen/include/asm-x86/mm.h         | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/mm/shadow/private.h b/xen/arch/x86/mm/shadow/private.h
index 6a03370..554905e8 100644
--- a/xen/arch/x86/mm/shadow/private.h
+++ b/xen/arch/x86/mm/shadow/private.h
@@ -529,7 +529,7 @@ static inline int sh_get_ref(struct domain *d, mfn_t smfn, 
paddr_t entry_pa)
     x = sp->u.sh.count;
     nx = x + 1;
 
-    if ( unlikely(nx >= 1U<<26) )
+    if ( unlikely(nx >= (1U << PAGE_SH_REFCOUNT_WIDTH)) )
     {
         SHADOW_PRINTK("shadow ref overflow, gmfn=%lx smfn=%lx\n",
                        __backpointer(sp), mfn_x(smfn));
diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index 8362608..7e9f306 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -82,7 +82,8 @@ struct page_info
             unsigned long type:5;   /* What kind of shadow is this? */
             unsigned long pinned:1; /* Is the shadow pinned? */
             unsigned long head:1;   /* Is this the first page of the shadow? */
-            unsigned long count:25; /* Reference count */
+#define PAGE_SH_REFCOUNT_WIDTH 25
+            unsigned long count:PAGE_SH_REFCOUNT_WIDTH; /* Reference count */
         } sh;
 
         /* Page is on a free list: ((count_info & PGC_count_mask) == 0). */
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.10

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog