36a2e6774b
While we sync many unsync sp at one time(in mmu_sync_children()), we may mapping the spte writable, it's dangerous, if one unsync sp's mapping gfn is another unsync page's gfn. For example: SP1.pte[0] = P SP2.gfn's pfn = P [SP1.pte[0] = SP2.gfn's pfn] First, we write protected SP1 and SP2, but SP1 and SP2 are still the unsync sp. Then, sync SP1 first, it will detect SP1.pte[0].gfn only has one unsync-sp, that is SP2, so it will mapping it writable, but we plan to sync SP2 soon, at this point, the SP2->unsync is not reliable since later we sync SP2 but SP2->gfn is already writable. So the final result is: SP2 is the sync page but SP2.gfn is writable. This bug will corrupt guest's page table, fixed by mark read-only mapping if the mapped gfn has shadow pages. Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> |
||
---|---|---|
.. | ||
alpha | ||
arm | ||
avr32 | ||
blackfin | ||
cris | ||
frv | ||
h8300 | ||
ia64 | ||
m32r | ||
m68k | ||
m68knommu | ||
microblaze | ||
mips | ||
mn10300 | ||
parisc | ||
powerpc | ||
s390 | ||
score | ||
sh | ||
sparc | ||
um | ||
x86 | ||
xtensa | ||
.gitignore | ||
Kconfig |