From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Grall Subject: Re: [PATCH] xen: arm: do not BUG on guest paddrs which are very high Date: Fri, 06 Dec 2013 16:05:47 +0000 Message-ID: <52A1F5DB.5060005@linaro.org> References: <1386248008-10820-1-git-send-email-ian.campbell@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1386248008-10820-1-git-send-email-ian.campbell@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Ian Campbell , xen-devel@lists.xen.org Cc: tim@xen.org, stefano.stabellini@eu.citrix.com List-Id: xen-devel@lists.xenproject.org On 12/05/2013 12:53 PM, Ian Campbell wrote: > The BUG_ON in p2m_map_first was over aggressive since the paddr_t can have > come from the guest, via add_to_physmap. Instead return failure to the caller. > > Also the check was simultaneously too lose. The valid offsets are > 0..P2M_FIRST_ENTRIES-1 inclusive. > > Signed-off-by: Ian Campbell > --- > xen/arch/arm/p2m.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c > index 1d5c841..cd134d4 100644 > --- a/xen/arch/arm/p2m.c > +++ b/xen/arch/arm/p2m.c > @@ -58,7 +58,8 @@ static lpae_t *p2m_map_first(struct p2m_domain *p2m, paddr_t addr) > { > struct page_info *page; > > - BUG_ON(first_linear_offset(addr) > P2M_FIRST_ENTRIES); > + if ( first_linear_offset(addr) >= P2M_FIRST_ENTRIES ) > + return NULL; > > page = p2m->first_level + p2m_first_level_index(addr); > > @@ -80,6 +81,8 @@ paddr_t p2m_lookup(struct domain *d, paddr_t paddr) > spin_lock(&p2m->lock); > > first = p2m_map_first(p2m, paddr); > + if ( !first ) > + goto done; If you jump to done, you will use pte which is uninitialized. Unlock the spinlock should be enough here. -- Julien Grall