From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50727) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVkwz-0007jM-TY for qemu-devel@nongnu.org; Thu, 03 Apr 2014 12:57:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WVkwe-0007yX-L0 for qemu-devel@nongnu.org; Thu, 03 Apr 2014 12:57:13 -0400 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:47479) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVkwe-0007xa-FQ for qemu-devel@nongnu.org; Thu, 03 Apr 2014 12:56:52 -0400 From: Peter Maydell Date: Thu, 3 Apr 2014 17:45:07 +0100 Message-Id: <1396543508-12280-2-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1396543508-12280-1-git-send-email-peter.maydell@linaro.org> References: <1396543508-12280-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH for-2.0? 1/2] page_check_range: don't bail out early after unprotecting page List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Riku Voipio , Richard Henderson , "Andrei E. Warkentin" , patches@linaro.org From: Andrei Warkentin When checking a page range, if we found that a page was made read-only by QEMU because it contained translated code, we were incorrectly returning immediately after unprotecting that page, rather than continuing to check the entire range, so we might fail to unprotect pages later in the range, or might incorrectly return a "success" result even if later pages were not writable. In particular, this could cause segfaults in a case where signals are delivered back to back on a target architecture which uses trampoline code in the stack frame (as AArch64 currently does). The second signal causes a segfault because the frame cannot be written to (it was protected because we translated and executed the restorer trampoline, and the unprotect logic did not unprotect the whole range). Signed-off-by: Andrei Warkentin --- translate-all.c | 1 - 1 file changed, 1 deletion(-) diff --git a/translate-all.c b/translate-all.c index f243c10..5759974 100644 --- a/translate-all.c +++ b/translate-all.c @@ -1777,7 +1777,6 @@ int page_check_range(target_ulong start, target_ulong len, int flags) return -1; } } - return 0; } } return 0; -- 1.9.0