Commit 0160676b authored by David Vrabel's avatar David Vrabel Committed by Konrad Rzeszutek Wilk

xen/p2m: check MFN is in range before using the m2p table

On hosts with more than 168 GB of memory, a 32-bit guest may attempt
to grant map an MFN that is error cannot lookup in its mapping of the
m2p table.  There is an m2p lookup as part of m2p_add_override() and
m2p_remove_override().  The lookup falls off the end of the mapped
portion of the m2p and (because the mapping is at the highest virtual
address) wraps around and the lookup causes a fault on what appears to
be a user space address.

do_page_fault() (thinking it's a fault to a userspace address), tries
to lock mm->mmap_sem.  If the gntdev device is used for the grant map,
m2p_add_override() is called from from gnttab_mmap() with mm->mmap_sem
already locked.  do_page_fault() then deadlocks.

The deadlock would most commonly occur when a 64-bit guest is started
and xenconsoled attempts to grant map its console ring.

Introduce mfn_to_pfn_no_overrides() which checks the MFN is within the
mapped portion of the m2p table before accessing the table and use
this in m2p_add_override(), m2p_remove_override(), and mfn_to_pfn()
(which already had the correct range check).

All faults caused by accessing the non-existant parts of the m2p are
thus within the kernel address space and exception_fixup() is called
without trying to lock mm->mmap_sem.

This means that for MFNs that are outside the mapped range of the m2p
then mfn_to_pfn() will always look in the m2p overrides.  This is
correct because it must be a foreign MFN (and the PFN in the m2p in
this case is only relevant for the other domain).
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
Cc: Stefano Stabellini <stefano.stabellini@citrix.com>
Cc: Jan Beulich <JBeulich@suse.com>
--
v3: check for auto_translated_physmap in mfn_to_pfn_no_overrides()
v2: in mfn_to_pfn() look in m2p_overrides if the MFN is out of
    range as it's probably foreign.
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: default avatarStefano Stabellini <stefano.stabellini@eu.citrix.com>
parent 24f69373
...@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn) ...@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn)
return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY; return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY;
} }
static inline unsigned long mfn_to_pfn(unsigned long mfn) static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn)
{ {
unsigned long pfn; unsigned long pfn;
int ret = 0; int ret;
if (xen_feature(XENFEAT_auto_translated_physmap)) if (xen_feature(XENFEAT_auto_translated_physmap))
return mfn; return mfn;
if (unlikely(mfn >= machine_to_phys_nr)) { if (unlikely(mfn >= machine_to_phys_nr))
pfn = ~0; return ~0;
goto try_override;
}
pfn = 0;
/* /*
* The array access can fail (e.g., device space beyond end of RAM). * The array access can fail (e.g., device space beyond end of RAM).
* In such cases it doesn't matter what we return (we return garbage), * In such cases it doesn't matter what we return (we return garbage),
* but we must handle the fault without crashing! * but we must handle the fault without crashing!
*/ */
ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
try_override:
/* ret might be < 0 if there are no entries in the m2p for mfn */
if (ret < 0) if (ret < 0)
pfn = ~0; return ~0;
else if (get_phys_to_machine(pfn) != mfn)
return pfn;
}
static inline unsigned long mfn_to_pfn(unsigned long mfn)
{
unsigned long pfn;
if (xen_feature(XENFEAT_auto_translated_physmap))
return mfn;
pfn = mfn_to_pfn_no_overrides(mfn);
if (get_phys_to_machine(pfn) != mfn) {
/* /*
* If this appears to be a foreign mfn (because the pfn * If this appears to be a foreign mfn (because the pfn
* doesn't map back to the mfn), then check the local override * doesn't map back to the mfn), then check the local override
...@@ -111,6 +119,7 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn) ...@@ -111,6 +119,7 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn)
* m2p_find_override_pfn returns ~0 if it doesn't find anything. * m2p_find_override_pfn returns ~0 if it doesn't find anything.
*/ */
pfn = m2p_find_override_pfn(mfn, ~0); pfn = m2p_find_override_pfn(mfn, ~0);
}
/* /*
* pfn is ~0 if there are no entries in the m2p for mfn or if the * pfn is ~0 if there are no entries in the m2p for mfn or if the
......
...@@ -879,7 +879,6 @@ int m2p_add_override(unsigned long mfn, struct page *page, ...@@ -879,7 +879,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
unsigned long uninitialized_var(address); unsigned long uninitialized_var(address);
unsigned level; unsigned level;
pte_t *ptep = NULL; pte_t *ptep = NULL;
int ret = 0;
pfn = page_to_pfn(page); pfn = page_to_pfn(page);
if (!PageHighMem(page)) { if (!PageHighMem(page)) {
...@@ -926,8 +925,8 @@ int m2p_add_override(unsigned long mfn, struct page *page, ...@@ -926,8 +925,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
* frontend pages while they are being shared with the backend, * frontend pages while they are being shared with the backend,
* because mfn_to_pfn (that ends up being called by GUPF) will * because mfn_to_pfn (that ends up being called by GUPF) will
* return the backend pfn rather than the frontend pfn. */ * return the backend pfn rather than the frontend pfn. */
ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); pfn = mfn_to_pfn_no_overrides(mfn);
if (ret == 0 && get_phys_to_machine(pfn) == mfn) if (get_phys_to_machine(pfn) == mfn)
set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)); set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
return 0; return 0;
...@@ -942,7 +941,6 @@ int m2p_remove_override(struct page *page, ...@@ -942,7 +941,6 @@ int m2p_remove_override(struct page *page,
unsigned long uninitialized_var(address); unsigned long uninitialized_var(address);
unsigned level; unsigned level;
pte_t *ptep = NULL; pte_t *ptep = NULL;
int ret = 0;
pfn = page_to_pfn(page); pfn = page_to_pfn(page);
mfn = get_phys_to_machine(pfn); mfn = get_phys_to_machine(pfn);
...@@ -1029,8 +1027,8 @@ int m2p_remove_override(struct page *page, ...@@ -1029,8 +1027,8 @@ int m2p_remove_override(struct page *page,
* the original pfn causes mfn_to_pfn(mfn) to return the frontend * the original pfn causes mfn_to_pfn(mfn) to return the frontend
* pfn again. */ * pfn again. */
mfn &= ~FOREIGN_FRAME_BIT; mfn &= ~FOREIGN_FRAME_BIT;
ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); pfn = mfn_to_pfn_no_overrides(mfn);
if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) && if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
m2p_find_override(mfn) == NULL) m2p_find_override(mfn) == NULL)
set_phys_to_machine(pfn, mfn); set_phys_to_machine(pfn, mfn);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment