xen/balloon: flush persistent kmaps in correct position
Xen balloon driver will update ballooned out pages' P2M entries to point
to scratch page for PV guests. In 24f69373e2
("xen/balloon: don't alloc
page while non-preemptible", kmap_flush_unused was moved after updating
P2M table. In that case for 32 bit PV guest we might end up with
P2M X -----> S (S is mfn of balloon scratch page)
M2P Y -----> X (Y is mfn in persistent kmap entry)
kmap_flush_unused() iterates through all the PTEs in the kmap address
space, using pte_to_page() to obtain the page. If the p2m and the m2p
are inconsistent the incorrect page is returned. This will clear
page->address on the wrong page which may cause subsequent oopses if
that page is currently kmap'ed.
Move the flush back between get_page and __set_phys_to_machine to fix
this.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: stable@vger.kernel.org # 3.12+
This commit is contained in:
parent
b098d6726b
commit
09ed3d5ba0
|
@ -399,12 +399,26 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
|
|||
state = BP_EAGAIN;
|
||||
break;
|
||||
}
|
||||
|
||||
pfn = page_to_pfn(page);
|
||||
frame_list[i] = pfn_to_mfn(pfn);
|
||||
|
||||
scrub_page(page);
|
||||
|
||||
frame_list[i] = page_to_pfn(page);
|
||||
}
|
||||
|
||||
/*
|
||||
* Ensure that ballooned highmem pages don't have kmaps.
|
||||
*
|
||||
* Do this before changing the p2m as kmap_flush_unused()
|
||||
* reads PTEs to obtain pages (and hence needs the original
|
||||
* p2m entry).
|
||||
*/
|
||||
kmap_flush_unused();
|
||||
|
||||
/* Update direct mapping, invalidate P2M, and add to balloon. */
|
||||
for (i = 0; i < nr_pages; i++) {
|
||||
pfn = frame_list[i];
|
||||
frame_list[i] = pfn_to_mfn(pfn);
|
||||
page = pfn_to_page(pfn);
|
||||
|
||||
#ifdef CONFIG_XEN_HAVE_PVMMU
|
||||
/*
|
||||
* Ballooned out frames are effectively replaced with
|
||||
|
@ -429,11 +443,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
|
|||
}
|
||||
#endif
|
||||
|
||||
balloon_append(pfn_to_page(pfn));
|
||||
balloon_append(page);
|
||||
}
|
||||
|
||||
/* Ensure that ballooned highmem pages don't have kmaps. */
|
||||
kmap_flush_unused();
|
||||
flush_tlb_all();
|
||||
|
||||
set_xen_guest_handle(reservation.extent_start, frame_list);
|
||||
|
|
Loading…
Reference in a new issue