Re: [PATCH 2/2] arm/xen: Add misuse warning to virt_to_gfn

["Jürgen Groß" <jgross@suse.com>]

On 26.08.20 20:37, Julien Grall wrote:
> Hi Simon,
> 
> On 25/08/2020 10:31, Simon Leiner wrote:
>> As virt_to_gfn uses virt_to_phys, it will return invalid addresses when
>> used with vmalloc'd addresses. This patch introduces a warning, when
>> virt_to_gfn is used in this way.
>>
>> Signed-off-by: Simon Leiner <simon@leiner.me>
>> ---
>>   include/xen/arm/page.h | 6 +++++-
>>   1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/xen/arm/page.h b/include/xen/arm/page.h
>> index d7f6af50e200..b0d303b633d0 100644
>> --- a/include/xen/arm/page.h
>> +++ b/include/xen/arm/page.h
>> @@ -76,7 +76,11 @@ static inline unsigned long bfn_to_pfn(unsigned 
>> long bfn)
>>   #define bfn_to_local_pfn(bfn)    bfn_to_pfn(bfn)
>>   /* VIRT <-> GUEST conversion */
>> -#define virt_to_gfn(v)        (pfn_to_gfn(virt_to_phys(v) >> 
>> XEN_PAGE_SHIFT))
>> +#define 
>> virt_to_gfn(v)                                                         \
>> +    
>> ({                                                                     \
>> +        WARN_ON_ONCE(is_vmalloc_addr(v));                              \
> 
> virt_to_gfn() will usually be called from generic code. WARN_ON_ONCE() 

"Usually" is a bit gross here. The only generic call site I could find
is xenbus_grant_ring(). All other instances (I counted 22) are not
generic at all.

> will only catch one instance and it means we would have to fix the first 
> instance and then re-run to catch the others.
> 
> So I think we want to switch to WARN_ON() here.

No, please don't. In case there would be a frequent path the result
would be a basically unusable system due to massive console clobbering.


Juergen