From patchwork Thu May 9 12:35:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 10937113 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ACB98924 for ; Thu, 9 May 2019 12:37:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9BCB82871E for ; Thu, 9 May 2019 12:37:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8F0D428928; Thu, 9 May 2019 12:37:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 2C7E22871E for ; Thu, 9 May 2019 12:37:12 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hOiH7-0008Iu-6b; Thu, 09 May 2019 12:35:49 +0000 Received: from us1-rack-dfw2.inumbo.com ([104.130.134.6]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hOiH5-0008Ip-VY for xen-devel@lists.xenproject.org; Thu, 09 May 2019 12:35:48 +0000 X-Inumbo-ID: f7c355e5-7256-11e9-8980-bc764e045a96 Received: from prv1-mh.provo.novell.com (unknown [137.65.248.33]) by us1-rack-dfw2.inumbo.com (Halon) with ESMTPS id f7c355e5-7256-11e9-8980-bc764e045a96; Thu, 09 May 2019 12:35:46 +0000 (UTC) Received: from INET-PRV1-MTA by prv1-mh.provo.novell.com with Novell_GroupWise; Thu, 09 May 2019 06:35:45 -0600 Message-Id: <5CD41EA1020000780022D25D@prv1-mh.provo.novell.com> X-Mailer: Novell GroupWise Internet Agent 18.1.0 Date: Thu, 09 May 2019 06:35:45 -0600 From: "Jan Beulich" To: "xen-devel" Mime-Version: 1.0 Content-Disposition: inline Subject: [Xen-devel] [PATCH] page-alloc: detect double free earlier X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Stefano Stabellini , Wei Liu , Konrad Rzeszutek Wilk , George Dunlap , Andrew Cooper , Ian Jackson , Tim Deegan , Julien Grall Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Right now this goes unnoticed until some subsequent page allocator operation stumbles across the thus corrupted list. We can do better: Only PGC_state_inuse and PGC_state_offlining pages can legitimately be passed to free_heap_pages(). Take the opportunity and also restrict the PGC_broken check to the PGC_state_offlining case, as only pages of that type or PGC_state_offlined may have this flag set on them. Similarly, since PGC_state_offlined is not a valid input state, the setting of "tainted" can be restricted to just this case. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper , with a suggestion. --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1409,13 +1409,22 @@ static void free_heap_pages( * in its pseudophysical address space). * In all the above cases there can be no guest mappings of this page. */ - ASSERT(!page_state_is(&pg[i], offlined)); - pg[i].count_info = - ((pg[i].count_info & PGC_broken) | - (page_state_is(&pg[i], offlining) - ? PGC_state_offlined : PGC_state_free)); - if ( page_state_is(&pg[i], offlined) ) + switch ( pg[i].count_info & PGC_state ) + { + case PGC_state_inuse: + BUG_ON(pg[i].count_info & PGC_broken); + pg[i].count_info = PGC_state_free; + break; + + case PGC_state_offlining: + pg[i].count_info = (pg[i].count_info & PGC_broken) | + PGC_state_offlined; tainted = 1; + break; + + default: + BUG(); + } /* If a page has no owner it will need no safety TLB flush. */ pg[i].u.free.need_tlbflush = (page_get_owner(&pg[i]) != NULL);