File 5c7e6f86-gnttab-set-refcount-for-transfer-copy.... of Package xen.10697

Overview Repositories Revisions Requests Users Attributes Meta

File 5c7e6f86-gnttab-set-refcount-for-transfer-copy.patch of Package xen.10697

# Commit 6d4f36c3fecc0a6a0991716199612c81d909316e
# Date 2019-03-05 13:45:58 +0100
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
gnttab: set page refcount for copy-on-grant-transfer

Commit 5cc77f9098 ("32-on-64: Fix domain address-size clamping,
implement"), which introduced this functionality, took care of clearing
the old page's PGC_allocated, but failed to set the bit (and install the
associated reference) on the newly allocated one. Furthermore the "mfn"
local variable was never updated, and hence the wrong MFN was passed to
guest_physmap_add_page() (and back to the destination domain) in this
case, leading to an IOMMU mapping into an unowned page.

Ideally the code would use assign_pages(), but the call to
gnttab_prepare_for_transfer() sits in the middle of the actions
mirroring that function.

This is XSA-284.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>

--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -1688,6 +1688,8 @@ gnttab_transfer(
             page->count_info &= ~(PGC_count_mask|PGC_allocated);
             free_domheap_page(page);
             page = new_page;
+            page->count_info = PGC_allocated | 1;
+            mfn = page_to_mfn(page);
         }
 
         spin_lock(&e->page_alloc_lock);

Places

File 5c7e6f86-gnttab-set-refcount-for-transfer-copy.patch of Package xen.10697

Places