KVM: MMU: avoid creation of unreachable pages in the shadow
It is possible for a shadow page to have a parent link pointing to a freed page. When zapping a high level table, kvm_mmu_page_unlink_children fails to remove the parent_pte link. For that to happen, the child must be unreachable via the shadow tree, which can happen in shadow_walk_entry if the guest pte was modified in between walk() and fetch(). Remove the parent pte reference in such case. Possible cause for oops in bug #2217430. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com>
This commit is contained in:
parent
c30f8a6c6d
commit
6c475352e8
|
@ -331,6 +331,7 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw,
|
||||||
r = kvm_read_guest_atomic(vcpu->kvm, gw->pte_gpa[level - 2],
|
r = kvm_read_guest_atomic(vcpu->kvm, gw->pte_gpa[level - 2],
|
||||||
&curr_pte, sizeof(curr_pte));
|
&curr_pte, sizeof(curr_pte));
|
||||||
if (r || curr_pte != gw->ptes[level - 2]) {
|
if (r || curr_pte != gw->ptes[level - 2]) {
|
||||||
|
kvm_mmu_put_page(shadow_page, sptep);
|
||||||
kvm_release_pfn_clean(sw->pfn);
|
kvm_release_pfn_clean(sw->pfn);
|
||||||
sw->sptep = NULL;
|
sw->sptep = NULL;
|
||||||
return 1;
|
return 1;
|
||||||
|
|
Loading…
Reference in New Issue