mirror of
https://github.com/torvalds/linux.git
synced 2024-11-13 23:51:39 +00:00
36a2e6774b
While we sync many unsync sp at one time(in mmu_sync_children()), we may mapping the spte writable, it's dangerous, if one unsync sp's mapping gfn is another unsync page's gfn. For example: SP1.pte[0] = P SP2.gfn's pfn = P [SP1.pte[0] = SP2.gfn's pfn] First, we write protected SP1 and SP2, but SP1 and SP2 are still the unsync sp. Then, sync SP1 first, it will detect SP1.pte[0].gfn only has one unsync-sp, that is SP2, so it will mapping it writable, but we plan to sync SP2 soon, at this point, the SP2->unsync is not reliable since later we sync SP2 but SP2->gfn is already writable. So the final result is: SP2 is the sync page but SP2.gfn is writable. This bug will corrupt guest's page table, fixed by mark read-only mapping if the mapped gfn has shadow pages. Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> |
||
|---|---|---|
| .. | ||
| emulate.c | ||
| i8254.c | ||
| i8254.h | ||
| i8259.c | ||
| irq.c | ||
| irq.h | ||
| Kconfig | ||
| kvm_cache_regs.h | ||
| kvm_timer.h | ||
| lapic.c | ||
| lapic.h | ||
| Makefile | ||
| mmu.c | ||
| mmu.h | ||
| mmutrace.h | ||
| paging_tmpl.h | ||
| svm.c | ||
| timer.c | ||
| trace.h | ||
| tss.h | ||
| vmx.c | ||
| x86.c | ||
| x86.h | ||