• D
    xen/p2m: check MFN is in range before using the m2p table · 0160676b
    David Vrabel 提交于
    On hosts with more than 168 GB of memory, a 32-bit guest may attempt
    to grant map an MFN that is error cannot lookup in its mapping of the
    m2p table.  There is an m2p lookup as part of m2p_add_override() and
    m2p_remove_override().  The lookup falls off the end of the mapped
    portion of the m2p and (because the mapping is at the highest virtual
    address) wraps around and the lookup causes a fault on what appears to
    be a user space address.
    
    do_page_fault() (thinking it's a fault to a userspace address), tries
    to lock mm->mmap_sem.  If the gntdev device is used for the grant map,
    m2p_add_override() is called from from gnttab_mmap() with mm->mmap_sem
    already locked.  do_page_fault() then deadlocks.
    
    The deadlock would most commonly occur when a 64-bit guest is started
    and xenconsoled attempts to grant map its console ring.
    
    Introduce mfn_to_pfn_no_overrides() which checks the MFN is within the
    mapped portion of the m2p table before accessing the table and use
    this in m2p_add_override(), m2p_remove_override(), and mfn_to_pfn()
    (which already had the correct range check).
    
    All faults caused by accessing the non-existant parts of the m2p are
    thus within the kernel address space and exception_fixup() is called
    without trying to lock mm->mmap_sem.
    
    This means that for MFNs that are outside the mapped range of the m2p
    then mfn_to_pfn() will always look in the m2p overrides.  This is
    correct because it must be a foreign MFN (and the PFN in the m2p in
    this case is only relevant for the other domain).
    Signed-off-by: NDavid Vrabel <david.vrabel@citrix.com>
    Cc: Stefano Stabellini <stefano.stabellini@citrix.com>
    Cc: Jan Beulich <JBeulich@suse.com>
    --
    v3: check for auto_translated_physmap in mfn_to_pfn_no_overrides()
    v2: in mfn_to_pfn() look in m2p_overrides if the MFN is out of
        range as it's probably foreign.
    Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
    0160676b
p2m.c 34.9 KB