From dc80c424844578048b457730e293a65267dea01c Mon Sep 17 00:00:00 2001 From: Paul Durrant Date: Mon, 26 Nov 2018 17:54:24 +0100 Subject: [PATCH] viridian: fix assertion failure MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Whilst attempting to crash an apparently wedged Windows domain using 'xen-hvmcrash' I managed to trigger the following ASSERT: (XEN) Assertion '!vp->ptr' failed at viridian.c:607 with stack: (XEN) [] viridian_map_guest_page+0x1b4/0x1b6 (XEN) [] viridian_synic_load_vcpu_ctxt+0x39/0x3b (XEN) [] viridian.c#viridian_load_vcpu_ctxt+0x93/0xcc (XEN) [] hvm_load+0x10e/0x19e (XEN) [] arch_do_domctl+0xb74/0x25b4 (XEN) [] do_domctl+0x16f7/0x19d8 This happened because viridian_map_guest_page() was not written to cope with being called multiple times, but this is unfortunately exactly what happens when xen-hvmcrash re-loads the domain context (having clobbered the values of RIP). This patch simply makes viridian_map_guest_page() return immediately if it finds the page already mapped (i.e. vp->ptr != NULL). Signed-off-by: Paul Durrant Reviewed-by: Roger Pau Monné --- xen/arch/x86/hvm/viridian/viridian.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c index 7d73f41de6..c78b2918d9 100644 --- a/xen/arch/x86/hvm/viridian/viridian.c +++ b/xen/arch/x86/hvm/viridian/viridian.c @@ -602,10 +602,12 @@ void viridian_map_guest_page(struct vcpu *v, struct viridian_page *vp) { struct domain *d = v->domain; unsigned long gmfn = vp->msr.fields.pfn; - struct page_info *page = get_page_from_gfn(d, gmfn, NULL, P2M_ALLOC); + struct page_info *page; - ASSERT(!vp->ptr); + if ( vp->ptr ) + return; + page = get_page_from_gfn(d, gmfn, NULL, P2M_ALLOC); if ( !page ) goto fail; -- 2.39.5