@@ -977,6 +977,7 @@ static int xenmem_add_to_physmap_one(
{
unsigned long mfn = 0;
int rc;
+ p2m_type_t t;
switch ( space )
{
@@ -1009,22 +1010,33 @@ static int xenmem_add_to_physmap_one(
d->arch.grant_table_gpfn[idx] = gpfn;
+ t = p2m_ram_rw;
+
spin_unlock(&d->grant_table->lock);
break;
case XENMAPSPACE_shared_info:
- if ( idx == 0 )
- mfn = virt_to_mfn(d->shared_info);
- else
+ if ( idx != 0 )
return -EINVAL;
+
+ mfn = virt_to_mfn(d->shared_info);
+ t = p2m_ram_rw;
+
break;
case XENMAPSPACE_gmfn_foreign:
{
- paddr_t maddr;
struct domain *od;
+ struct page_info *page;
+ p2m_type_t p2mt;
od = rcu_lock_domain_by_any_id(foreign_domid);
if ( od == NULL )
return -ESRCH;
+ if ( od == d )
+ {
+ rcu_unlock_domain(od);
+ return -EINVAL;
+ }
+
rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od);
if ( rc )
{
@@ -1032,15 +1044,25 @@ static int xenmem_add_to_physmap_one(
return rc;
}
- maddr = p2m_lookup(od, pfn_to_paddr(idx), NULL);
- if ( maddr == INVALID_PADDR )
+ /* Take reference to the foreign domain page.
+ * Reference will be released in XENMEM_remove_from_physmap */
+ page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC);
+ if ( !page )
{
dump_p2m_lookup(od, pfn_to_paddr(idx));
rcu_unlock_domain(od);
return -EINVAL;
}
- mfn = maddr >> PAGE_SHIFT;
+ if ( !p2m_is_ram(p2mt) )
+ {
+ put_page(page);
+ rcu_unlock_domain(od);
+ return -EINVAL;
+ }
+
+ mfn = page_to_mfn(page);
+ t = p2m_map_foreign;
rcu_unlock_domain(od);
break;
@@ -1051,7 +1073,7 @@ static int xenmem_add_to_physmap_one(
}
/* Map at new location. */
- rc = guest_physmap_add_page(d, gpfn, mfn, 0);
+ rc = guest_physmap_add_entry(d, gpfn, mfn, 0, t);
return rc;
}
@@ -47,6 +47,7 @@ typedef enum {
} p2m_type_t;
#define p2m_is_foreign(_t) ((_t) == p2m_map_foreign)
+#define p2m_is_ram(_t) ((_t) == p2m_ram_rw || (_t) == p2m_ram_ro)
/* Initialise vmid allocator */
void p2m_vmid_allocator_init(void);
Xen needs to know that the current page belongs to another domain. Also take a reference to this page. The current process to add a foreign page is: 1) get the page from the foreign p2m 2) take a reference on the page with the foreign domain in parameters 3) add the page to the current domain p2m If the foreign domain drops the page: - before 2), get_page will return NULL because the page doesn't belong anymore to the domain - after 2), the current domain already have a reference. Write will occur to an old page which is not yet released. It can corrupt the foreign domain. Signed-off-by: Julien Grall <julien.grall@linaro.org> Acked-by: Ian Campbell <ian.campbell@citrix.com> --- Changes in v5: - Missing rcu_unlock_domain in one path - Check if the foreign page is RAM Changes in v4: - Typo s/release/released/ - Improve commit message Changes in v3: - Typoes - Check if the foreign domain is different from the current domain Changes in v2: - Even if gcc is buggy (see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18501) define p2m type per mapspace to let the compiler warns about unitialized values. --- xen/arch/arm/mm.c | 38 ++++++++++++++++++++++++++++++-------- xen/include/asm-arm/p2m.h | 1 + 2 files changed, 31 insertions(+), 8 deletions(-)