]> xenbits.xensource.com Git - people/liuw/libxenctrl-split/xen.git/commit
x86/nHVM: avoid NULL deref during INVLPG intercept handling
authorJan Beulich <jbeulich@suse.com>
Tue, 9 Feb 2016 12:22:13 +0000 (13:22 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 9 Feb 2016 12:22:13 +0000 (13:22 +0100)
commit86c59615f4e7f38df24182f20d9dbdec3299c514
tree33369a946499b3430007e72eadc822e00b4333b6
parente2d1fe89da0ced77546e84e1563c906380a9274f
x86/nHVM: avoid NULL deref during INVLPG intercept handling

When intercepting (or emulating) L1 guest INVLPG, the nested P2M
pointer may be (is?) NULL, and hence there's no point in calling
p2m_flush(). In fact doing so would cause a dereference of that NULL
pointer at least in the ASSERT() right at the beginning of the
function.

While so far nothing supports hap_invlpg() being reachable from the
INVLPG intercept paths (only INVLPG insn emulation would lead there),
and hence the code in question (added by dd6de3ab99 ["Implement
Nested-on-Nested"]) appears to be dead, this seems to be the change
which can be agreed on as an immediate fix. Ideally, however, the
problematic code would go away altogether. See thread at
lists.xenproject.org/archives/html/xen-devel/2016-01/msg03762.html.

Reported-by: 刘令 <liuling-it@360.cn>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>
xen/arch/x86/mm/hap/hap.c