diff options
| author | Marcelo Tosatti <mtosatti@redhat.com> | 2008-11-25 15:33:10 +0100 |
|---|---|---|
| committer | Avi Kivity <avi@redhat.com> | 2008-11-26 12:34:27 +0200 |
| commit | 6c475352e87224a8f0b8cc6f6cc96b30563dc5b4 (patch) | |
| tree | 1046e74c244c3db4673fb937af8b56875405114c | |
| parent | c30f8a6c6d74f67bc2107726cc61a1e7c71e9740 (diff) | |
| download | linux-6c475352e87224a8f0b8cc6f6cc96b30563dc5b4.tar.gz linux-6c475352e87224a8f0b8cc6f6cc96b30563dc5b4.tar.bz2 linux-6c475352e87224a8f0b8cc6f6cc96b30563dc5b4.zip | |
KVM: MMU: avoid creation of unreachable pages in the shadow
It is possible for a shadow page to have a parent link
pointing to a freed page. When zapping a high level table,
kvm_mmu_page_unlink_children fails to remove the parent_pte link.
For that to happen, the child must be unreachable via the shadow
tree, which can happen in shadow_walk_entry if the guest pte was
modified in between walk() and fetch(). Remove the parent pte
reference in such case.
Possible cause for oops in bug #2217430.
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
| -rw-r--r-- | arch/x86/kvm/paging_tmpl.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h index 613ec9aa674a..84eee43bbe74 100644 --- a/arch/x86/kvm/paging_tmpl.h +++ b/arch/x86/kvm/paging_tmpl.h @@ -331,6 +331,7 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw, r = kvm_read_guest_atomic(vcpu->kvm, gw->pte_gpa[level - 2], &curr_pte, sizeof(curr_pte)); if (r || curr_pte != gw->ptes[level - 2]) { + kvm_mmu_put_page(shadow_page, sptep); kvm_release_pfn_clean(sw->pfn); sw->sptep = NULL; return 1; |