From: Tim Deegan <tim@xen.org>
To: Nai Xia <nai.xia@gmail.com>
Cc: Xiaowei Yang <xiaowei.yang@huawei.com>,
Andres Lagar-Cavilla <andreslc@gridcentric.ca>,
"Luohao (brian)" <brian.luohao@huawei.com>,
Lixiuchang <lixiuchang@huawei.com>,
xen-devel@lists.xensource.com
Subject: Re: Is this a racing bug in page_make_sharable()?
Date: Thu, 10 Jan 2013 13:00:58 +0000 [thread overview]
Message-ID: <20130110130058.GD99373@ocelot.phlegethon.org> (raw)
In-Reply-To: <50DC6ABF.7020003@gmail.com>
Hi,
At 23:35 +0800 on 27 Dec (1356651327), Nai Xia wrote:
> I think I can construct a bug by interleaving the two code paths:
>
> in guest_remove_page() | in page_make_sharable()
> ------------------------------------------------------------------------------------------------------------------------------
> if ( p2m_is_shared(p2mt) ) .....
> ... .....
> page = mfn_to_page(mfn); .....
> .....
>
> if (
> !get_page_and_type(page,
> d, PGT_shared_page) )
> // success
>
> .........
> if ( page->count_info !=
> (PGC_allocated | (2 +
> expected_refcnt)) ) //
> also pass
>
>
> if ( unlikely(!get_page(page, d)) )
>
> /* go on to remove page */ /* go on to add page to
> cow domain */
> -------------------------------------------------------------------------------------------------------------------------------------
>
>
> is there anything that can already prevent such racing or is this really
> can happen?
I think this race can happen. I'm not sure exactly what the effect
is, though. I guess the page ends up belonging to dom_cow, but
without the PGC_allocated bit set. So when it becomes unshared again,
it's immediately freed. :(
Andres, what do you think?
Tim.
next prev parent reply other threads:[~2013-01-10 13:00 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <4F14345B.4040807@gmail.com>
2012-01-16 14:43 ` Is this a racing bug in page_make_sharable()? Nai Xia
2012-01-17 10:53 ` Tim Deegan
2012-12-27 15:35 ` Nai Xia
2013-01-10 13:00 ` Tim Deegan [this message]
2013-01-10 16:36 ` Andres Lagar-Cavilla
2013-01-10 17:25 ` Tim Deegan
2013-01-11 2:46 ` Nai Xia
2012-01-16 14:51 Nai Xia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130110130058.GD99373@ocelot.phlegethon.org \
--to=tim@xen.org \
--cc=andreslc@gridcentric.ca \
--cc=brian.luohao@huawei.com \
--cc=lixiuchang@huawei.com \
--cc=nai.xia@gmail.com \
--cc=xen-devel@lists.xensource.com \
--cc=xiaowei.yang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).