From mboxrd@z Thu Jan 1 00:00:00 1970 From: Corneliu ZUZU Subject: [PATCH V2] arm: p2m.c bug-fix: hypervisor hang on __p2m_get_mem_access Date: Wed, 27 Jan 2016 14:24:35 +0200 Message-ID: <1453897475-19448-1-git-send-email-czuzu@bitdefender.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Stefano Stabellini , Ian Campbell List-Id: xen-devel@lists.xenproject.org When __p2m_get_mem_access gets called, the p2m lock is already taken by either get_page_from_gva or p2m_get_mem_access. Possible code paths: 1) -> get_page_from_gva -> p2m_mem_access_check_and_get_page -> __p2m_get_mem_access 2) -> p2m_get_mem_access -> __p2m_get_mem_access In both cases if __p2m_get_mem_access subsequently gets to call p2m_lookup (happens if !radix_tree_lookup(...)), a hypervisor hang will occur, since p2m_lookup also spin-locks on the p2m lock. This bug-fix simply replaces the p2m_lookup call from __p2m_get_mem_access with a call to __p2m_lookup. Following Ian's suggestion, we also add an ASSERT to ensure that the p2m lock is taken upon __p2m_get_mem_access entry. Signed-off-by: Corneliu ZUZU --- xen/arch/arm/p2m.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c index 2190908..e8e6db4 100644 --- a/xen/arch/arm/p2m.c +++ b/xen/arch/arm/p2m.c @@ -468,6 +468,8 @@ static int __p2m_get_mem_access(struct domain *d, gfn_t gfn, #undef ACCESS }; + ASSERT(spin_is_locked(&p2m->lock)); + /* If no setting was ever set, just return rwx. */ if ( !p2m->mem_access_enabled ) { @@ -490,7 +492,7 @@ static int __p2m_get_mem_access(struct domain *d, gfn_t gfn, * No setting was found in the Radix tree. Check if the * entry exists in the page-tables. */ - paddr_t maddr = p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL); + paddr_t maddr = __p2m_lookup(d, gfn_x(gfn) << PAGE_SHIFT, NULL); if ( INVALID_PADDR == maddr ) return -ESRCH; -- 2.5.0