From patchwork Mon Nov 25 13:49:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 11260429 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 83A7C6C1 for ; Mon, 25 Nov 2019 13:50:51 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 69D502082F for ; Mon, 25 Nov 2019 13:50:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 69D502082F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iZEkP-0005a7-W8; Mon, 25 Nov 2019 13:49:49 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1iZEkO-0005a2-Cx for xen-devel@lists.xenproject.org; Mon, 25 Nov 2019 13:49:48 +0000 X-Inumbo-ID: 70a87a3c-0f8a-11ea-b08b-bc764e2007e4 Received: from mx1.suse.de (unknown [195.135.220.15]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 70a87a3c-0f8a-11ea-b08b-bc764e2007e4; Mon, 25 Nov 2019 13:49:46 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 4EA07B29C; Mon, 25 Nov 2019 13:49:45 +0000 (UTC) To: "xen-devel@lists.xenproject.org" From: Jan Beulich Message-ID: Date: Mon, 25 Nov 2019 14:49:49 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 Content-Language: en-US Subject: [Xen-devel] [PATCH] x86/p2m-pt: fix (latent) page table mapping leak on do_recalc() error paths X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: George Dunlap , Andrew Cooper , Juergen Gross , Wei Liu , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" There are two mappings active in the middle of do_recalc(), and hence commit 0d0f4d78e5d1 ("p2m: change write_p2m_entry to return an error code") should have added (or otherwise invoked) unmapping code just like it did in p2m_next_level(), despite us not expecting any errors here. Arrange for the existing unmap invocation to take effect in all cases. Signed-off-by: Jan Beulich Reviewed-by: George Dunlap --- a/xen/arch/x86/mm/p2m-pt.c +++ b/xen/arch/x86/mm/p2m-pt.c @@ -391,21 +391,22 @@ static int do_recalc(struct p2m_domain * if ( err ) { ASSERT_UNREACHABLE(); - goto out; + break; } } remainder -= 1UL << ((level - 1) * PAGETABLE_ORDER); } smp_wmb(); - clear_recalc(l1, e); - err = p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1); - if ( err ) + if ( !err ) { - ASSERT_UNREACHABLE(); - goto out; + clear_recalc(l1, e); + err = p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1); + ASSERT(!err); } } unmap_domain_page((void *)((unsigned long)pent & PAGE_MASK)); + if ( unlikely(err) ) + goto out; } pent = p2m_find_entry(table, &gfn_remainder, gfn,