Commit bbc60c18 authored by Michael Abd-El-Malek's avatar Michael Abd-El-Malek Committed by Ingo Molnar
Browse files

xen: fix grant table bug 

fix memory corruption and crash due to mis-sized grant table.

A PV OS has two grant table data structures: the grant table itself
and a free list.  The free list is composed of an array of pages,
which grow dynamically as the guest OS requires more grants.  While
the grant table contains 8-byte entries, the free list contains 4-byte
entries.  So we have half as many pages in the free list than in the
grant table.

There was a bug in the free list allocation code. The free list was
indexed as if it was the same size as the grant table.  But it's only
half as large.  So memory got corrupted, and I was seeing crashes in
the slab allocator later on.

Taken from:

  http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/4018c0da3360



Signed-off-by: default avatarMichael Abd-El-Malek <mabdelmalek@cmu.edu>
Signed-off-by: default avatarMark McLoughlin <markmc@redhat.com>
Signed-off-by: default avatarJeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent bae1d250

drivers/xen/grant-table.c

+10 −6
Original line number Diff line number Diff line
@@ -381,11 +381,15 @@ EXPORT_SYMBOL_GPL(gnttab_cancel_free_callback); 
static int grow_gnttab_list(unsigned int more_frames)

{

	unsigned int new_nr_grant_frames, extra_entries, i;

	unsigned int nr_glist_frames, new_nr_glist_frames;



	new_nr_grant_frames = nr_grant_frames + more_frames;

	extra_entries       = more_frames * GREFS_PER_GRANT_FRAME;



	for (i = nr_grant_frames; i < new_nr_grant_frames; i++) {

	nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;

	new_nr_glist_frames =

		(new_nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;

	for (i = nr_glist_frames; i < new_nr_glist_frames; i++) {

		gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_ATOMIC);

		if (!gnttab_list[i])

			goto grow_nomem;
@@ -407,7 +411,7 @@ static int grow_gnttab_list(unsigned int more_frames) 
	return 0;



grow_nomem:

	for ( ; i >= nr_grant_frames; i--)

	for ( ; i >= nr_glist_frames; i--)

		free_page((unsigned long) gnttab_list[i]);

	return -ENOMEM;

}
@@ -530,7 +534,7 @@ static int gnttab_expand(unsigned int req_entries) 
static int __devinit gnttab_init(void)

{

	int i;

	unsigned int max_nr_glist_frames;

	unsigned int max_nr_glist_frames, nr_glist_frames;

	unsigned int nr_init_grefs;



	if (!is_running_on_xen())
@@ -543,15 +547,15 @@ static int __devinit gnttab_init(void) 
	 * grant reference free list on the current hypervisor.

	 */

	max_nr_glist_frames = (boot_max_nr_grant_frames *

			       GREFS_PER_GRANT_FRAME /

			       (PAGE_SIZE / sizeof(grant_ref_t)));

			       GREFS_PER_GRANT_FRAME / RPP);



	gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),

			      GFP_KERNEL);

	if (gnttab_list == NULL)

		return -ENOMEM;



	for (i = 0; i < nr_grant_frames; i++) {

	nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;

	for (i = 0; i < nr_glist_frames; i++) {

		gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL);

		if (gnttab_list[i] == NULL)

			goto ini_nomem;

CRA Git | Maintained and supported by SUSTech CRA and CCSE