From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Beulich" Subject: Re: tracking of Xen heap pages shared with guest Date: Fri, 14 Mar 2008 13:41:07 +0000 Message-ID: <47DA8E83.76E4.0078.0@novell.com> References: <47DA84C7.76E4.0078.0@novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Content-Disposition: inline List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Keir Fraser , xen-devel@lists.xensource.com Cc: joserenato.santos@hp.com List-Id: xen-devel@lists.xenproject.org >>> Keir Fraser 14.03.08 14:10 >>> >On 14/3/08 12:59, "Jan Beulich" wrote: > >> a) A guest unintentionally or maliciously frees (e.g. through >> decrease_reservation) a page shared from the Xen heap (e.g. the >> shared info page). From what I can see, such a page would have a >> reference count of 1 (from share_xen_page_with_guest(), assuming >> the guest doesn't have the page mapped), and would hence be >> immediately freed with the corresponding put_page(). Nevertheless >> Xen itself may continue to write to such a page. > >There is no extra reference count in this case. Xen's own reference is >implicit, and this is okay because such pages are explicitly freed during >domain final destruction, and at that point Xen knows the pages are going >away. Right, but the question was - what if the guest erroneously or maliciously frees the page? If there's indeed no extra reference, then the page (which Xen will continue to write to) may get assigned to a different domain, including dom0, and hence the whole system could get at risk. >> b) A domU that had a xenoprof buffer allocated gets killed. Since the >> xenoprof code directly calls free_xenheap_pages() on the buffer, >> any mapping dom0 may have to it would not be considered, and hence >> dom0 would retain a mapping to free memory. Additionally, the >> put_page() in unshare_xenoprof_page_with_guest() could revert the >> singe reference to the page established through >> share_xen_page_with_guest() (i.e. if dom0 never mapped or already >> unmapped the buffer), which again would result in the buffer getting >> freed (and thus d->xenoprof->rawbuf becoming stale). > >I'm no expert on xenoprof. I've cc'ed Renato. > >Wouldn't dom0 mappings bump the page reference count, and this would = prevent >the domU being destroyed (remember that non-empty domain page ownership >lists hold a domain reference)? As I understand it, the pages get shared with dom0, so ownership also transfers to dom0, which doesn't prevent the guest from being fully destroyed. Jan