Re: [PATCH v2 2/3] xen/mm: do not assign pages to a domain until they are scrubbed

[Jan Beulich <jbeulich@suse.com>]

On 26.03.2026 09:51, Roger Pau Monne wrote:
> Assigning pages to a domain make them the possible target of hypercalls
> like XENMEM_decrease_reservation ahead of such pages being scrubbed in
> populate_physmap() when the guest is running in PV mode.  This might allow
> pages to be freed ahead of being scrubbed for example, as a stubdomain
> already running could target them by guessing their MFNs.  It's also
> possible other action could set the page type ahead of scrubbing, which
> would be problematic.
> 
> Prevent the pages pending scrub from being assigned to the domain, and only
> do the assign once the scrubbing has finished.  This has the disadvantage
> that the allocated pages will be removed from the free pool, but not yet
> accounted towards the domain consumed page quota.  However there can only
> be one stashed page in that state, and it's maximum size is bounded by the
> memop-max-order option.  This is not too different from the current logic,
> where assigning pages to a domain (and thus checking whether such domain
> doesn't overflow it's quota) is also done after the memory has been
> allocated and removed from the pool of free pages.
> 
> Fixes: 83a784a15b47 ("xen/mm: allow deferred scrub of physmap populate allocated pages")
> Reported-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>