Re: [Xen-ia64-devel] [PATCH] fix gmfn_to_mfn

[Tristan Gingold <tgingold@xxxxxxx>]

On Fri, May 09, 2008 at 04:32:22PM +0900, Kouya Shimura wrote:
> Isaku Yamahata writes:
> > On Fri, May 09, 2008 at 03:07:53PM +0900, Kouya Shimura wrote:
> > Isn't prev_mfn != 0 check necessary?
> > guest_physmap_remove_page() with mfn = 0 hits BUG_ON()
> > (and guest_remove_page() calls guest_physmap_remove_page())
> 
> Hmm, Should BUG_ON() be removed from guest_physmap_remove_page()?
> If the page(mfn=0) is allocated to a guest, the guest can crash xen.

Yes, it would be nice to clean up all the issues with mfn = 0.

At this time any guest can crash dom 0 by using mfn = 0 during vbd transfer.

Tristan.

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel