mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-03 17:14:14 +08:00
lguest: Revert 1ce70c4fac
, fix real problem.
Ahmed managed to crash the Host in release_pgd(), which cannot be a Guest
bug, and indeed it wasn't.
The bug was that handing a 0 as the address of the toplevel page table
being manipulated can cause the lookup code in find_pgdir() to return
an uninitialized cache entry (we shadow up to 4 top level page tables
for each Guest).
Commit 37cc8d7f96
introduced this
behaviour in the Guest, uncovering the bug.
The patch which he submitted (which removed the /4 from the index
calculation) simply ensured that these high-indexed entries hit the
early exit path of guest_set_pmd(). But you get lots of segfaults in
guest userspace as the PMDs aren't being updated.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
parent
3fabc55f34
commit
4357bd9453
@ -480,7 +480,7 @@ static void lguest_set_pmd(pmd_t *pmdp, pmd_t pmdval)
|
||||
{
|
||||
*pmdp = pmdval;
|
||||
lazy_hcall(LHCALL_SET_PMD, __pa(pmdp)&PAGE_MASK,
|
||||
(__pa(pmdp)&(PAGE_SIZE-1)), 0);
|
||||
(__pa(pmdp)&(PAGE_SIZE-1))/4, 0);
|
||||
}
|
||||
|
||||
/* There are a couple of legacy places where the kernel sets a PTE, but we
|
||||
|
@ -391,7 +391,7 @@ static unsigned int find_pgdir(struct lguest *lg, unsigned long pgtable)
|
||||
{
|
||||
unsigned int i;
|
||||
for (i = 0; i < ARRAY_SIZE(lg->pgdirs); i++)
|
||||
if (lg->pgdirs[i].gpgdir == pgtable)
|
||||
if (lg->pgdirs[i].pgdir && lg->pgdirs[i].gpgdir == pgtable)
|
||||
break;
|
||||
return i;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user