Re: [Xen-devel] domU crashing Xen

To:	Chris Wright <chrisw@xxxxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject:	Re: [Xen-devel] domU crashing Xen
From:	Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Date:	Thu, 12 Oct 2006 09:34:18 +0100
Cc:	Jeremy Fitzhardinge <jeremy@xxxxxxxx>
Delivery-date:	Thu, 12 Oct 2006 01:34:54 -0700
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxx
In-reply-to:	<20061012062634.GA6201@xxxxxxxxxxxxxxxxxxxx>
List-help:	<mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id:	Xen developer discussion <xen-devel.lists.xensource.com>
List-post:	<mailto:xen-devel@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender:	xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index:	Acbt2TUHc8mQZ1nMEduTBwAX8io7RQ==
Thread-topic:	[Xen-devel] domU crashing Xen
User-agent:	Microsoft-Entourage/11.2.5.060620

On 12/10/06 07:26, "Chris Wright" <chrisw@xxxxxxxxxxxx> wrote:

> Haven't worked out exactly what's causing the bug, but in testing the
> pv_ops tree against current Xen (11736:f7d65fb7299b) I can reliably
> crash Xen with the following trace, caused by:
> 
> arch/x86/traps.c::handle_gdt_ldt_mapping_fault()
>     ...
>     /* Should never fault in another vcpu's area. */
>     BUG_ON(vcpu_area != current->vcpu_id);

The shadow-refcount code is quite fresh. We should confirm this isn't
exploitable by ordinary PV guests though.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

WARNING - OLD ARCHIVES

xen-devel

Re: [Xen-devel] domU crashing Xen