From mboxrd@z Thu Jan 1 00:00:00 1970 From: Radim =?utf-8?B?S3LEjW3DocWZ?= Subject: Re: [PATCH 2/2] KVM: x86: map/unmap private slots in __x86_set_memory_region Date: Tue, 13 Oct 2015 17:39:57 +0200 Message-ID: <20151013153957.GA9987@potion.brq.redhat.com> References: <1444651758-6926-1-git-send-email-pbonzini@redhat.com> <1444651758-6926-3-git-send-email-pbonzini@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, aderumier@odiso.com, stable@vger.kernel.org To: Paolo Bonzini Return-path: Content-Disposition: inline In-Reply-To: <1444651758-6926-3-git-send-email-pbonzini@redhat.com> Sender: stable-owner@vger.kernel.org List-Id: kvm.vger.kernel.org 2015-10-12 14:09+0200, Paolo Bonzini: > Otherwise, two copies (one of them never used and thus bogus) are > allocated for the regular and SMM address spaces. This breaks > SMM with EPT but without unrestricted guest support, because the > SMM copy of the identity page map is all zeros. (Have you found out why EPT+unrestricted didn't use the alternative SMM mapping as well?) > By moving the allocation to the caller we also remove the last > vestiges of kernel-allocated memory regions (not accessible anymore > in userspace since commit b74a07beed0e, "KVM: Remove kernel-allocated > memory regions", 2010-06-21); that is a nice bonus. >=20 > Reported-by: Alexandre DERUMIER > Cc: stable@vger.kernel.org > Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 > Signed-off-by: Paolo Bonzini > --- vm_mmap() leaks if __kvm_set_memory_region() fails. It's nothing new and following process termination should take care of it, Reviewed-by: Radim Kr=C4=8Dm=C3=A1=C5=99 > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > @@ -7717,23 +7717,53 @@ void kvm_arch_sync_events(struct kvm *kvm) > int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 = size) > { > int i, r; > + u64 hva; > + struct kvm_memslots *slots =3D kvm_memslots(kvm); > + struct kvm_memory_slot *slot, old; | [...] > + slot =3D &slots->memslots[slots->id_to_index[id]]; This seems better written as slot =3D id_to_memslot(slots, id); (Made me remember that I want to refactor the memslot API ...) | [...] > + } else { > + if (!slot->npages) > + return 0; > + > + hva =3D 0; > + } > + > + old =3D *slot; (Assignment could be in the 'else' =3D=3D !size branch, GCC would have = fun.) | [...] > + if (!size) { > + r =3D vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); > + WARN_ON(r < 0); > + }