All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paul Mackerras <paulus@ozlabs.org>
To: Greg Kurz <groug@kaod.org>
Cc: kvm-ppc@vger.kernel.org,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH 0/3] KVM: PPC: Fix host kernel crash with PR KVM
Date: Thu, 19 Mar 2020 23:34:34 +0000	[thread overview]
Message-ID: <20200319233434.GF3260@blackberry> (raw)
In-Reply-To: <158455340419.178873.11399595021669446372.stgit@bahia.lan>

On Wed, Mar 18, 2020 at 06:43:24PM +0100, Greg Kurz wrote:
> Recent cleanup from Sean Christopherson introduced a use-after-free
> condition that crashes the kernel when shutting down the VM with
> PR KVM. It went unnoticed so far because PR isn't tested/used much
> these days (mostly used for nested on POWER8, not supported on POWER9
> where HV should be used for nested), and other KVM implementations for
> ppc are unaffected.
> 
> This all boils down to the fact that the path that frees the per-vCPU
> MMU data goes through a complex set of indirections. This obfuscates
> the code to the point that we didn't realize that the MMU data was
> now being freed too early. And worse, most of the indirection isn't
> needed because only PR KVM has some MMU data to free when the vCPU is
> destroyed.
> 
> Fix the issue (patch 1) and simplify the code (patch 2 and 3).

I have put this series in my kvm-ppc-next branch, and I believe
Michael Ellerman is putting patch 1 in his fixes branch so it gets
into 5.6.

Thanks,
Paul.

WARNING: multiple messages have this Message-ID (diff)
From: Paul Mackerras <paulus@ozlabs.org>
To: Greg Kurz <groug@kaod.org>
Cc: kvm-ppc@vger.kernel.org,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH 0/3] KVM: PPC: Fix host kernel crash with PR KVM
Date: Fri, 20 Mar 2020 10:34:34 +1100	[thread overview]
Message-ID: <20200319233434.GF3260@blackberry> (raw)
In-Reply-To: <158455340419.178873.11399595021669446372.stgit@bahia.lan>

On Wed, Mar 18, 2020 at 06:43:24PM +0100, Greg Kurz wrote:
> Recent cleanup from Sean Christopherson introduced a use-after-free
> condition that crashes the kernel when shutting down the VM with
> PR KVM. It went unnoticed so far because PR isn't tested/used much
> these days (mostly used for nested on POWER8, not supported on POWER9
> where HV should be used for nested), and other KVM implementations for
> ppc are unaffected.
> 
> This all boils down to the fact that the path that frees the per-vCPU
> MMU data goes through a complex set of indirections. This obfuscates
> the code to the point that we didn't realize that the MMU data was
> now being freed too early. And worse, most of the indirection isn't
> needed because only PR KVM has some MMU data to free when the vCPU is
> destroyed.
> 
> Fix the issue (patch 1) and simplify the code (patch 2 and 3).

I have put this series in my kvm-ppc-next branch, and I believe
Michael Ellerman is putting patch 1 in his fixes branch so it gets
into 5.6.

Thanks,
Paul.

  parent reply	other threads:[~2020-03-19 23:34 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-18 17:43 [PATCH 0/3] KVM: PPC: Fix host kernel crash with PR KVM Greg Kurz
2020-03-18 17:43 ` Greg Kurz
2020-03-18 17:43 ` [PATCH 1/3] KVM: PPC: Fix " Greg Kurz
2020-03-18 17:43   ` Greg Kurz
2020-03-18 18:16   ` Sean Christopherson
2020-03-18 18:16     ` Sean Christopherson
2020-03-21 11:37   ` Michael Ellerman
2020-03-21 11:37     ` Michael Ellerman
2020-03-18 17:43 ` [PATCH 2/3] KVM: PPC: Move kvmppc_mmu_init() " Greg Kurz
2020-03-18 17:43   ` Greg Kurz
2020-03-18 17:43 ` [PATCH 3/3] KVM: PPC: Kill kvmppc_ops::mmu_destroy() and kvmppc_mmu_destroy() Greg Kurz
2020-03-18 17:43   ` Greg Kurz
2020-03-19 23:34 ` Paul Mackerras [this message]
2020-03-19 23:34   ` [PATCH 0/3] KVM: PPC: Fix host kernel crash with PR KVM Paul Mackerras

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200319233434.GF3260@blackberry \
    --to=paulus@ozlabs.org \
    --cc=groug@kaod.org \
    --cc=kvm-ppc@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=pbonzini@redhat.com \
    --cc=sean.j.christopherson@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.