Re: [Xen-devel] Is this a racing bug in page_make_sharable()?

[Tim Deegan <tim@xxxxxxx>]

Hi,

At 23:35 +0800 on 27 Dec (1356651327), Nai Xia wrote:
> I think I can construct a bug by interleaving the two code paths:
> 
> in guest_remove_page()              |              in page_make_sharable()
> ------------------------------------------------------------------------------------------------------------------------------
> if ( p2m_is_shared(p2mt) )                       .....
> ...                                              .....
> page = mfn_to_page(mfn);                         .....
>                                                  .....
> 
>                                                  if ( 
>                                                  !get_page_and_type(page, 
>                                                  d, PGT_shared_page) )    
>                                                  // success
> 
>                                                  .........
>                                                  if ( page->count_info != 
>                                                  (PGC_allocated | (2 + 
>                                                  expected_refcnt)) ) // 
>                                                  also pass
> 
> 
> if ( unlikely(!get_page(page, d)) )
> 
> /* go on to remove page */                       /* go on to add page to 
> cow domain */
> -------------------------------------------------------------------------------------------------------------------------------------
> 
> 
> is there anything that can already prevent such racing or is this really 
> can happen?

I think this race can happen.  I'm not sure exactly what the effect
is, though.  I guess the page ends up belonging to dom_cow, but
without the PGC_allocated bit set.  So when it becomes unshared again,
it's immediately freed. :(

Andres, what do you think?

Tim.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel