bitkeeper revision 1.1236.33.3 (4236d576pkc2uu_icflDqtaz0FvliA)

Bug fix for shadow_get_page_from_l1e().  Don't try to look for the
owner of an invalid mfn.

Signed-off-by: michael.fetterman@cl.cam.ac.uk

diff --git a/xen/arch/x86/shadow.c b/xen/arch/x86/shadow.c
index e087574b86a8dc4aa6c5cc64abac298f0ee74bf0..3df883974271f4d203d8bc1e23905cbb20dc320c 100644 (file)
--- a/xen/arch/x86/shadow.c
+++ b/xen/arch/x86/shadow.c
@@ -1724,7 +1724,8 @@ void __shadow_sync_all(struct domain *d)
         unsigned long opte = *ppte;
         unsigned long npte = opte & ~_PAGE_RW;
 
-        shadow_get_page_from_l1e(mk_l1_pgentry(npte), d);
+        if ( npte & _PAGE_PRESENT)
+            shadow_get_page_from_l1e(mk_l1_pgentry(npte), d);
         *ppte = npte;
         put_page_from_l1e(mk_l1_pgentry(opte), d);
 

diff --git a/xen/include/asm-x86/shadow.h b/xen/include/asm-x86/shadow.h
index 6ec919c6592fd91469ba704d56b6ae3960bd94d9..204ca7cc891272827e674e47e10777a8b08651c2 100644 (file)
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -246,9 +246,15 @@ static inline int
 shadow_get_page_from_l1e(l1_pgentry_t l1e, struct domain *d)
 {
     int res = get_page_from_l1e(l1e, d);
+    unsigned long mfn;
     struct domain *owner;
 
+    ASSERT( l1_pgentry_val(l1e) & _PAGE_PRESENT );
+
     if ( unlikely(!res) && IS_PRIV(d) && !shadow_mode_translate(d) &&
+         !(l1_pgentry_val(l1e) & L1_DISALLOW_MASK) &&
+         (mfn = l1_pgentry_to_pfn(l1e)) &&
+         pfn_is_ram(mfn) &&
          (owner = page_get_owner(pfn_to_page(l1_pgentry_to_pfn(l1e)))) &&
          (d != owner) )
     {