Fix infinite recursion loop in get_page_type() error path.

Signed-off-by: Keir Fraser <keir@xensource.com>
xen-unstable changeset:   10183:c43080e63545c2c9ba101fd8864b5aacc5d666e2
xen-unstable date:        Tue May 30 18:11:34 2006 +0100

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 564d7e6f98e72a9f57b31f534348388e6073b562..63292be3fb07ca60126ba110b20ee2c81269b2d6 100644 (file)
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -1497,12 +1497,18 @@ int get_page_type(struct page_info *page, unsigned long type)
             {
                 if ( unlikely((x & PGT_type_mask) != (type & PGT_type_mask) ) )
                 {
-                    if ( current->domain == page_get_owner(page) )
+                    if ( (current->domain == page_get_owner(page)) &&
+                         ((x & PGT_type_mask) == PGT_writable_page) )
                     {
                         /*
                          * This ensures functions like set_gdt() see up-to-date
                          * type info without needing to clean up writable p.t.
-                         * state on the fast path.
+                         * state on the fast path. We take this path only
+                         * when the current type is writable because:
+                         *  1. It's the only type that this path can decrement.
+                         *  2. If we take this path more liberally then we can
+                         *     enter a recursive loop via get_page_from_l1e()
+                         *     during pagetable revalidation.
                          */
                         LOCK_BIGLOCK(current->domain);
                         cleanup_writable_pagetable(current->domain);