From c8fad5e035f7e129d8ce88de6f6c9d9ffda45ada Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 12 Dec 2017 15:12:45 +0100 Subject: [PATCH] x86/shadow: fix refcount overflow check Commit c385d27079 ("x86 shadow: for multi-page shadows, explicitly track the first page") reduced the refcount width to 25, without adjusting the overflow check. Eliminate the disconnect by using a manifest constant. Interestingly, up to commit 047782fa01 ("Out-of-sync L1 shadows: OOS snapshot") the refcount was 27 bits wide, yet the check was already using 26. This is XSA-249. Signed-off-by: Jan Beulich Reviewed-by: George Dunlap Reviewed-by: Tim Deegan master commit: 54e2292e8df7a1a7b041192be9d6d797b6d00869 master date: 2017-12-12 14:29:13 +0100 --- xen/arch/x86/mm/shadow/private.h | 2 +- xen/include/asm-x86/mm.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/shadow/private.h b/xen/arch/x86/mm/shadow/private.h index b778fcfa50..0e7aca1410 100644 --- a/xen/arch/x86/mm/shadow/private.h +++ b/xen/arch/x86/mm/shadow/private.h @@ -524,7 +524,7 @@ static inline int sh_get_ref(struct vcpu *v, mfn_t smfn, paddr_t entry_pa) x = sp->u.sh.count; nx = x + 1; - if ( unlikely(nx >= 1U<<26) ) + if ( unlikely(nx >= (1U << PAGE_SH_REFCOUNT_WIDTH)) ) { SHADOW_PRINTK("shadow ref overflow, gmfn=%lx smfn=%lx\n", __backpointer(sp), mfn_x(smfn)); diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h index 558b7f00f2..6031b4cd65 100644 --- a/xen/include/asm-x86/mm.h +++ b/xen/include/asm-x86/mm.h @@ -77,7 +77,8 @@ struct page_info unsigned long type:5; /* What kind of shadow is this? */ unsigned long pinned:1; /* Is the shadow pinned? */ unsigned long head:1; /* Is this the first page of the shadow? */ - unsigned long count:25; /* Reference count */ +#define PAGE_SH_REFCOUNT_WIDTH 25 + unsigned long count:PAGE_SH_REFCOUNT_WIDTH; /* Reference count */ } sh; /* Page is on a free list: ((count_info & PGC_count_mask) == 0). */