linux/arch
David Vrabel 0160676bba xen/p2m: check MFN is in range before using the m2p table
On hosts with more than 168 GB of memory, a 32-bit guest may attempt
to grant map an MFN that is error cannot lookup in its mapping of the
m2p table.  There is an m2p lookup as part of m2p_add_override() and
m2p_remove_override().  The lookup falls off the end of the mapped
portion of the m2p and (because the mapping is at the highest virtual
address) wraps around and the lookup causes a fault on what appears to
be a user space address.

do_page_fault() (thinking it's a fault to a userspace address), tries
to lock mm->mmap_sem.  If the gntdev device is used for the grant map,
m2p_add_override() is called from from gnttab_mmap() with mm->mmap_sem
already locked.  do_page_fault() then deadlocks.

The deadlock would most commonly occur when a 64-bit guest is started
and xenconsoled attempts to grant map its console ring.

Introduce mfn_to_pfn_no_overrides() which checks the MFN is within the
mapped portion of the m2p table before accessing the table and use
this in m2p_add_override(), m2p_remove_override(), and mfn_to_pfn()
(which already had the correct range check).

All faults caused by accessing the non-existant parts of the m2p are
thus within the kernel address space and exception_fixup() is called
without trying to lock mm->mmap_sem.

This means that for MFNs that are outside the mapped range of the m2p
then mfn_to_pfn() will always look in the m2p overrides.  This is
correct because it must be a foreign MFN (and the PFN in the m2p in
this case is only relevant for the other domain).

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: Stefano Stabellini <stefano.stabellini@citrix.com>
Cc: Jan Beulich <JBeulich@suse.com>
--
v3: check for auto_translated_physmap in mfn_to_pfn_no_overrides()
v2: in mfn_to_pfn() look in m2p_overrides if the MFN is out of
    range as it's probably foreign.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2013-09-25 09:00:03 -04:00
..
alpha alpha: Use handle_percpu_irq for the timer interrupt 2013-07-19 13:54:26 -07:00
arc ARC: [lib] strchr breakage in Big-endian configuration 2013-08-24 11:24:53 -07:00
arm Linux 3.11-rc7 2013-09-09 12:05:37 -04:00
arm64 Perf backend fixes for arm64 where the user can cause kernel panic 2013-08-21 16:36:32 -07:00
avr32 avr32: boards/atngw100/mrmt.c: fix building error 2013-08-08 14:16:22 +02:00
blackfin Merge branch 'cpuinit_phase2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2013-07-18 10:50:26 -07:00
c6x Merge branch 'akpm' (updates from Andrew Morton) 2013-07-03 17:12:13 -07:00
cris cris: delete __cpuinit usage from all cris files 2013-07-14 19:36:54 -04:00
frv frv: delete __cpuinit usage from all frv files 2013-07-14 19:36:55 -04:00
h8300 net: rename busy poll socket op and globals 2013-07-10 17:08:27 -07:00
hexagon arch: *: Kconfig: add "kernel/Kconfig.freezer" to "arch/*/Kconfig" 2013-08-13 17:57:49 -07:00
ia64 Fix TLB gather virtual address range invalidation corner cases 2013-08-16 08:52:46 -07:00
m32r m32r: delete __cpuinit usage from all m32r files 2013-07-14 19:36:55 -04:00
m68k m68k: Truncate base in do_div() 2013-08-14 11:46:30 +02:00
metag metag: delete __cpuinit usage from all metag files 2013-07-14 19:36:54 -04:00
microblaze microblaze: fix clone syscall 2013-08-13 17:57:48 -07:00
mips MIPS: Handle OCTEON BBIT instructions in FPU emulator. 2013-08-20 19:17:40 +02:00
mn10300 net: rename busy poll socket op and globals 2013-07-10 17:08:27 -07:00
openrisc arch: *: Kconfig: add "kernel/Kconfig.freezer" to "arch/*/Kconfig" 2013-08-13 17:57:49 -07:00
parisc parisc: Fix interrupt routing for C8000 serial ports 2013-07-31 23:42:32 +02:00
powerpc powerpc/tm: Fix context switching TAR, PPR and DSCR SPRs 2013-08-09 18:07:12 +10:00
s390 s390: Fix broken build 2013-08-16 21:16:37 -07:00
score arch: *: Kconfig: add "kernel/Kconfig.freezer" to "arch/*/Kconfig" 2013-08-13 17:57:49 -07:00
sh Fix TLB gather virtual address range invalidation corner cases 2013-08-16 08:52:46 -07:00
sparc sparc: delete __cpuinit/__CPUINIT usage from all users 2013-07-14 19:36:52 -04:00
tile tile: delete __cpuinit usage from all tile files 2013-07-14 19:36:54 -04:00
um Fix TLB gather virtual address range invalidation corner cases 2013-08-16 08:52:46 -07:00
unicore32 reboot: move arch/x86 reboot= handling to generic kernel 2013-07-09 10:33:29 -07:00
x86 xen/p2m: check MFN is in range before using the m2p table 2013-09-25 09:00:03 -04:00
xtensa xtensa: delete __cpuinit usage from all xtensa files 2013-07-14 19:36:56 -04:00
.gitignore
Kconfig microblaze: fix clone syscall 2013-08-13 17:57:48 -07:00