[xen stable-4.16] x86/shadow: drop (replace) bogus assertions

[patchbot@xxxxxxx]

commit 9fdb4f17656f74b35af0882b558e44832ff00b5f
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Oct 31 13:24:33 2022 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Oct 31 13:24:33 2022 +0100

    x86/shadow: drop (replace) bogus assertions
    
    The addition of a call to shadow_blow_tables() from shadow_teardown()
    has resulted in the "no vcpus" related assertion becoming triggerable:
    If domain_create() fails with at least one page successfully allocated
    in the course of shadow_enable(), or if domain_create() succeeds and
    the domain is then killed without ever invoking XEN_DOMCTL_max_vcpus.
    Note that in-tree tests (test-resource and test-tsx) do exactly the
    latter of these two.
    
    The assertion's comment was bogus anyway: Shadow mode has been getting
    enabled before allocation of vCPU-s for quite some time. Convert the
    assertion to a conditional: As long as there are no vCPU-s, there's
    nothing to blow away.
    
    Fixes: e7aa55c0aab3 ("x86/p2m: free the paging memory pool preemptively")
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    
    A similar assertion/comment pair exists in _shadow_prealloc(); the
    comment is similarly bogus, and the assertion could in principle trigger
    e.g. when shadow_alloc_p2m_page() is called early enough. Replace those
    at the same time by a similar early return, here indicating failure to
    the caller (which will generally lead to the domain being crashed in
    shadow_prealloc()).
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: a92dc2bb30ba65ae25d2f417677eb7ef9a6a0fef
    master date: 2022-10-24 15:46:11 +0200
---
 xen/arch/x86/mm/shadow/common.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index 3b0d781991..1de0139742 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -943,8 +943,9 @@ static bool __must_check _shadow_prealloc(struct domain *d, 
unsigned int pages)
         /* No reclaim when the domain is dying, teardown will take care of it. 
*/
         return false;
 
-    /* Shouldn't have enabled shadows if we've no vcpus. */
-    ASSERT(d->vcpu && d->vcpu[0]);
+    /* Nothing to reclaim when there are no vcpus yet. */
+    if ( !d->vcpu[0] )
+        return false;
 
     /* Stage one: walk the list of pinned pages, unpinning them */
     perfc_incr(shadow_prealloc_1);
@@ -1034,8 +1035,9 @@ void shadow_blow_tables(struct domain *d)
     mfn_t smfn;
     int i;
 
-    /* Shouldn't have enabled shadows if we've no vcpus. */
-    ASSERT(d->vcpu && d->vcpu[0]);
+    /* Nothing to do when there are no vcpus yet. */
+    if ( !d->vcpu[0] )
+        return;
 
     /* Pass one: unpin all pinned pages */
     foreach_pinned_shadow(d, sp, t)
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.16