From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: [PATCH for 4.5] xen/arm: p2m: Fix crash when p2m_lookup is used with an invalid IPA Date: Mon, 20 Oct 2014 14:21:05 +0100 Message-ID: <1413811265.4087.24.camel@citrix.com> References: <1413660321-14620-1-git-send-email-julien.grall@linaro.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1XgCta-0004PG-Lb for xen-devel@lists.xenproject.org; Mon, 20 Oct 2014 13:21:10 +0000 In-Reply-To: <1413660321-14620-1-git-send-email-julien.grall@linaro.org> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Julien Grall Cc: xen-devel@lists.xenproject.org, tim@xen.org, stefano.stabellini@citrix.com List-Id: xen-devel@lists.xenproject.org On Sat, 2014-10-18 at 20:25 +0100, Julien Grall wrote: > Since the commit 58f0fd8 "xen: arm: handle variable p2m levels in p2m_lookup", > Xen checks that the root_table offset is valid. If not, its unlock the p2m > spinlock before returning an error. But, at this time, the lock has not been > taken. > > On Xen built with debug=y, we can get the following stack trace if the guest > use an invalid IPA in hypercall or mess-up the grant-table: > > (XEN) Assertion '_raw_spin_is_locked(lock)' failed at xen/include/asm/arm32/spinlock.h:22 > ... > (XEN) [<0022d1bc>] _spin_unlock+0x2c/0x50 (PC) > (XEN) [<00253264>] p2m_lookup+0x20c/0x230 (LR) > (XEN) [<7ffdfd54>] 7ffdfd54 > (XEN) [<002539f4>] gmfn_to_mfn+0x24/0x3c > (XEN) [<0020e4d4>] __get_paged_frame+0x30/0x12c > (XEN) [<00210680>] __acquire_grant_for_copy+0x4e0/0x768 > (XEN) [<00212030>] do_grant_table_op+0x13a0/0x2534 > (XEN) [<00257b10>] do_trap_hypervisor+0xe10/0x1148 > (XEN) [<0025b330>] return_from_trap+0/0x4 > > Signed-off-by: Julien Grall acked + applied, thanks.