6c475352e8
It is possible for a shadow page to have a parent link pointing to a freed page. When zapping a high level table, kvm_mmu_page_unlink_children fails to remove the parent_pte link. For that to happen, the child must be unreachable via the shadow tree, which can happen in shadow_walk_entry if the guest pte was modified in between walk() and fetch(). Remove the parent pte reference in such case. Possible cause for oops in bug #2217430. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> |
||
|---|---|---|
| .. | ||
| i8254.c | ||
| i8254.h | ||
| i8259.c | ||
| irq.c | ||
| irq.h | ||
| Kconfig | ||
| kvm_cache_regs.h | ||
| kvm_svm.h | ||
| lapic.c | ||
| lapic.h | ||
| Makefile | ||
| mmu.c | ||
| mmu.h | ||
| paging_tmpl.h | ||
| svm.c | ||
| svm.h | ||
| tss.h | ||
| vmx.c | ||
| vmx.h | ||
| x86.c | ||
| x86.h | ||
| x86_emulate.c | ||