[Xen-changelog] [xen master] mm: Safe to clear PGC_allocated on xenheap pages without an extra reference

[patchbot@xxxxxxx]

commit 45ce5b8749a220ad7c4ce5d5eba7c201a9418078
Author:     George Dunlap <george.dunlap@xxxxxxxxxx>
AuthorDate: Tue Aug 6 12:19:55 2019 +0100
Commit:     George Dunlap <george.dunlap@xxxxxxxxxx>
CommitDate: Tue Aug 6 12:19:55 2019 +0100

    mm: Safe to clear PGC_allocated on xenheap pages without an extra reference
    
    Commits ec83f825627 "mm.h: add helper function to test-and-clear
    _PGC_allocated" (and subsequent fix-up 44a887d021d "mm.h: fix BUG_ON()
    condition in put_page_alloc_ref()") introduced a BUG_ON() to detect
    unsafe behavior of callers.
    
    Unfortunately this condition still turns out to be too strict.
    xenheap pages are somewhat "magic": calling free_domheap_pages() on
    them will not cause free_heap_pages() to be called: whichever part of
    Xen allocated them specially must call free_xenheap_pages()
    specifically.  (They'll also be handled appropriately at domain
    destruction time.)
    
    Only crash Xen when put_page_alloc_ref() finds only a single refcount
    if the page is not a xenheap page.
    
    Signed-off-by: George Dunlap <george.dunlap@xxxxxxxxxx>
    Tested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/include/xen/mm.h | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
index 977e45aae7..f2d0cd0ace 100644
--- a/xen/include/xen/mm.h
+++ b/xen/include/xen/mm.h
@@ -666,15 +666,19 @@ static inline void share_xen_page_with_privileged_guests(
 static inline void put_page_alloc_ref(struct page_info *page)
 {
     /*
-     * Whenever a page is assigned to a domain then the _PGC_allocated bit
-     * is set and the reference count is set to at least 1. This function
-     * clears that 'allocation reference' but it is unsafe to do so without
-     * the caller holding an additional reference. I.e. the allocation
-     * reference must never be the last reference held.
+     * Whenever a page is assigned to a domain then the _PGC_allocated
+     * bit is set and the reference count is set to at least 1. This
+     * function clears that 'allocation reference' but it is unsafe to
+     * do so to domheap pages without the caller holding an additional
+     * reference. I.e. the allocation reference must never be the last
+     * reference held.
+     *
+     * (It's safe for xenheap pages, because put_page() will not cause
+     * them to be freed.)
      */
     if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
     {
-        BUG_ON((page->count_info & PGC_count_mask) <= 1);
+        BUG_ON((page->count_info & (PGC_xen_heap | PGC_count_mask)) <= 1);
         put_page(page);
     }
 }
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog