diff options
| author | Rusty Russell <rusty@rustcorp.com.au> | 2008-03-11 15:35:57 +0100 |
|---|---|---|
| committer | Rusty Russell <rusty@rustcorp.com.au> | 2008-03-10 23:35:58 +0100 |
| commit | 4357bd9453b81e0a41db1dec16e06d74256b7560 (patch) | |
| tree | 4b23d512d6cbe26ac2b4a0dfaff7e415bd1dab7c /drivers/lguest | |
| parent | lguest: Sanitize the lguest clock. (diff) | |
| download | linux-4357bd9453b81e0a41db1dec16e06d74256b7560.tar.xz linux-4357bd9453b81e0a41db1dec16e06d74256b7560.zip | |
lguest: Revert 1ce70c4fac3c3954bd48c035f448793867592bc0, fix real problem.
Ahmed managed to crash the Host in release_pgd(), which cannot be a Guest
bug, and indeed it wasn't.
The bug was that handing a 0 as the address of the toplevel page table
being manipulated can cause the lookup code in find_pgdir() to return
an uninitialized cache entry (we shadow up to 4 top level page tables
for each Guest).
Commit 37cc8d7f963ba2deec29c9b68716944516a3244f introduced this
behaviour in the Guest, uncovering the bug.
The patch which he submitted (which removed the /4 from the index
calculation) simply ensured that these high-indexed entries hit the
early exit path of guest_set_pmd(). But you get lots of segfaults in
guest userspace as the PMDs aren't being updated.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'drivers/lguest')
| -rw-r--r-- | drivers/lguest/page_tables.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c index 275f23c2deb4..a7f64a9d67e0 100644 --- a/drivers/lguest/page_tables.c +++ b/drivers/lguest/page_tables.c @@ -391,7 +391,7 @@ static unsigned int find_pgdir(struct lguest *lg, unsigned long pgtable) { unsigned int i; for (i = 0; i < ARRAY_SIZE(lg->pgdirs); i++) - if (lg->pgdirs[i].gpgdir == pgtable) + if (lg->pgdirs[i].pgdir && lg->pgdirs[i].gpgdir == pgtable) break; return i; } |