aboutsummaryrefslogtreecommitdiffstats
path: root/arch/x86
diff options
context:
space:
mode:
authorRusty Russell <rusty@rustcorp.com.au>2008-03-11 10:35:57 -0400
committerRusty Russell <rusty@rustcorp.com.au>2008-03-10 18:35:58 -0400
commit4357bd9453b81e0a41db1dec16e06d74256b7560 (patch)
tree4b23d512d6cbe26ac2b4a0dfaff7e415bd1dab7c /arch/x86
parent3fabc55f34b72720e8a10aa442bd3415a211edb3 (diff)
lguest: Revert 1ce70c4fac3c3954bd48c035f448793867592bc0, fix real problem.
Ahmed managed to crash the Host in release_pgd(), which cannot be a Guest bug, and indeed it wasn't. The bug was that handing a 0 as the address of the toplevel page table being manipulated can cause the lookup code in find_pgdir() to return an uninitialized cache entry (we shadow up to 4 top level page tables for each Guest). Commit 37cc8d7f963ba2deec29c9b68716944516a3244f introduced this behaviour in the Guest, uncovering the bug. The patch which he submitted (which removed the /4 from the index calculation) simply ensured that these high-indexed entries hit the early exit path of guest_set_pmd(). But you get lots of segfaults in guest userspace as the PMDs aren't being updated. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'arch/x86')
-rw-r--r--arch/x86/lguest/boot.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 9c27c104d83c..a104c532ff70 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -480,7 +480,7 @@ static void lguest_set_pmd(pmd_t *pmdp, pmd_t pmdval)
480{ 480{
481 *pmdp = pmdval; 481 *pmdp = pmdval;
482 lazy_hcall(LHCALL_SET_PMD, __pa(pmdp)&PAGE_MASK, 482 lazy_hcall(LHCALL_SET_PMD, __pa(pmdp)&PAGE_MASK,
483 (__pa(pmdp)&(PAGE_SIZE-1)), 0); 483 (__pa(pmdp)&(PAGE_SIZE-1))/4, 0);
484} 484}
485 485
486/* There are a couple of legacy places where the kernel sets a PTE, but we 486/* There are a couple of legacy places where the kernel sets a PTE, but we