ia64/linux-2.6.18-xen.hg

changeset 504:4018c0da3360

xen: fix grant table bug

A PV OS has two grant table data structures: the grant table itself
and a free list. The free list is composed of an array of pages,
which grow dynamically as the guest OS requires more grants. While
the grant table contains 8-byte entries, the free list contains 4-byte
entries. So we have half as many pages in the free list than in the
grant table.

There was a bug in the free list allocation code. The free list was
indexed as if it was the same size as the grant table. But it's only
half as large. So memory got corrupted, and I was seeing crashes in
the slab allocator later on.

Signed-off-by: Michael Abd-El-Malek <mabdelmalek@cmu.edu>
author Keir Fraser <keir.fraser@citrix.com>
date Mon Mar 31 11:03:07 2008 +0100 (2008-03-31)
parents 5486a234923d
children 06ffa3eb5e3f
files drivers/xen/core/gnttab.c
line diff
     1.1 --- a/drivers/xen/core/gnttab.c	Mon Mar 31 10:32:25 2008 +0100
     1.2 +++ b/drivers/xen/core/gnttab.c	Mon Mar 31 11:03:07 2008 +0100
     1.3 @@ -52,7 +52,7 @@
     1.4  /* External tools reserve first few grant table entries. */
     1.5  #define NR_RESERVED_ENTRIES 8
     1.6  #define GNTTAB_LIST_END 0xffffffff
     1.7 -#define GREFS_PER_GRANT_FRAME (PAGE_SIZE / sizeof(grant_entry_t))
     1.8 +#define ENTRIES_PER_GRANT_FRAME (PAGE_SIZE / sizeof(grant_entry_t))
     1.9  
    1.10  static grant_ref_t **gnttab_list;
    1.11  static unsigned int nr_grant_frames;
    1.12 @@ -70,6 +70,9 @@ static int gnttab_expand(unsigned int re
    1.13  #define RPP (PAGE_SIZE / sizeof(grant_ref_t))
    1.14  #define gnttab_entry(entry) (gnttab_list[(entry) / RPP][(entry) % RPP])
    1.15  
    1.16 +#define nr_freelist_frames(grant_frames)				\
    1.17 +	(((grant_frames) * ENTRIES_PER_GRANT_FRAME + RPP - 1) / RPP)
    1.18 +
    1.19  static int get_free_entries(int count)
    1.20  {
    1.21  	unsigned long flags;
    1.22 @@ -372,24 +375,25 @@ EXPORT_SYMBOL_GPL(gnttab_cancel_free_cal
    1.23  static int grow_gnttab_list(unsigned int more_frames)
    1.24  {
    1.25  	unsigned int new_nr_grant_frames, extra_entries, i;
    1.26 +	unsigned int nr_glist_frames, new_nr_glist_frames;
    1.27  
    1.28  	new_nr_grant_frames = nr_grant_frames + more_frames;
    1.29 -	extra_entries       = more_frames * GREFS_PER_GRANT_FRAME;
    1.30 +	extra_entries       = more_frames * ENTRIES_PER_GRANT_FRAME;
    1.31  
    1.32 -	for (i = nr_grant_frames; i < new_nr_grant_frames; i++)
    1.33 -	{
    1.34 +	nr_glist_frames = nr_freelist_frames(nr_grant_frames);
    1.35 +	new_nr_glist_frames = nr_freelist_frames(new_nr_grant_frames);
    1.36 +	for (i = nr_glist_frames; i < new_nr_glist_frames; i++) {
    1.37  		gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_ATOMIC);
    1.38  		if (!gnttab_list[i])
    1.39  			goto grow_nomem;
    1.40  	}
    1.41  
    1.42 -
    1.43 -	for (i = GREFS_PER_GRANT_FRAME * nr_grant_frames;
    1.44 -	     i < GREFS_PER_GRANT_FRAME * new_nr_grant_frames - 1; i++)
    1.45 +	for (i = ENTRIES_PER_GRANT_FRAME * nr_grant_frames;
    1.46 +	     i < ENTRIES_PER_GRANT_FRAME * new_nr_grant_frames - 1; i++)
    1.47  		gnttab_entry(i) = i + 1;
    1.48  
    1.49  	gnttab_entry(i) = gnttab_free_head;
    1.50 -	gnttab_free_head = GREFS_PER_GRANT_FRAME * nr_grant_frames;
    1.51 +	gnttab_free_head = ENTRIES_PER_GRANT_FRAME * nr_grant_frames;
    1.52  	gnttab_free_count += extra_entries;
    1.53  
    1.54  	nr_grant_frames = new_nr_grant_frames;
    1.55 @@ -399,7 +403,7 @@ static int grow_gnttab_list(unsigned int
    1.56  	return 0;
    1.57  	
    1.58  grow_nomem:
    1.59 -	for ( ; i >= nr_grant_frames; i--)
    1.60 +	for ( ; i >= nr_glist_frames; i--)
    1.61  		free_page((unsigned long) gnttab_list[i]);
    1.62  	return -ENOMEM;
    1.63  }
    1.64 @@ -699,8 +703,8 @@ static int gnttab_expand(unsigned int re
    1.65  	unsigned int cur, extra;
    1.66  
    1.67  	cur = nr_grant_frames;
    1.68 -	extra = ((req_entries + (GREFS_PER_GRANT_FRAME-1)) /
    1.69 -		 GREFS_PER_GRANT_FRAME);
    1.70 +	extra = ((req_entries + (ENTRIES_PER_GRANT_FRAME-1)) /
    1.71 +		 ENTRIES_PER_GRANT_FRAME);
    1.72  	if (cur + extra > max_nr_grant_frames())
    1.73  		return -ENOSPC;
    1.74  
    1.75 @@ -713,7 +717,7 @@ static int gnttab_expand(unsigned int re
    1.76  int __devinit gnttab_init(void)
    1.77  {
    1.78  	int i;
    1.79 -	unsigned int max_nr_glist_frames;
    1.80 +	unsigned int max_nr_glist_frames, nr_glist_frames;
    1.81  	unsigned int nr_init_grefs;
    1.82  
    1.83  	if (!is_running_on_xen())
    1.84 @@ -725,16 +729,15 @@ int __devinit gnttab_init(void)
    1.85  	/* Determine the maximum number of frames required for the
    1.86  	 * grant reference free list on the current hypervisor.
    1.87  	 */
    1.88 -	max_nr_glist_frames = (boot_max_nr_grant_frames *
    1.89 -			       GREFS_PER_GRANT_FRAME /
    1.90 -			       (PAGE_SIZE / sizeof(grant_ref_t)));
    1.91 +	max_nr_glist_frames = nr_freelist_frames(boot_max_nr_grant_frames);
    1.92  
    1.93  	gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),
    1.94  			      GFP_KERNEL);
    1.95  	if (gnttab_list == NULL)
    1.96  		return -ENOMEM;
    1.97  
    1.98 -	for (i = 0; i < nr_grant_frames; i++) {
    1.99 +	nr_glist_frames = nr_freelist_frames(nr_grant_frames);
   1.100 +	for (i = 0; i < nr_glist_frames; i++) {
   1.101  		gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL);
   1.102  		if (gnttab_list[i] == NULL)
   1.103  			goto ini_nomem;
   1.104 @@ -743,7 +746,7 @@ int __devinit gnttab_init(void)
   1.105  	if (gnttab_resume() < 0)
   1.106  		return -ENODEV;
   1.107  
   1.108 -	nr_init_grefs = nr_grant_frames * GREFS_PER_GRANT_FRAME;
   1.109 +	nr_init_grefs = nr_grant_frames * ENTRIES_PER_GRANT_FRAME;
   1.110  
   1.111  	for (i = NR_RESERVED_ENTRIES; i < nr_init_grefs - 1; i++)
   1.112  		gnttab_entry(i) = i + 1;