Re: [PATCH for 3.3] KVM: Fix write protection race during dirty logging

[Marcelo Tosatti <mtosatti@redhat.com>]

On Sun, Feb 05, 2012 at 08:42:41PM +0900, Takuya Yoshikawa wrote:
> From: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
> 
> This patch fixes a race introduced by:
> 
>   commit 95d4c16ce78cb6b7549a09159c409d52ddd18dae
>   KVM: Optimize dirty logging by rmap_write_protect()
> 
> During protecting pages for dirty logging, other threads may also try
> to protect a page in mmu_sync_children() or kvm_mmu_get_page().
> 
> In such a case, because get_dirty_log releases mmu_lock before flushing
> TLB's, the following race condition can happen:
> 
>   A (get_dirty_log)     B (another thread)
> 
>   lock(mmu_lock)
>   clear pte.w
>   unlock(mmu_lock)
>                         lock(mmu_lock)
>                         pte.w is already cleared
>                         unlock(mmu_lock)
>                         skip TLB flush
>                         return
>   ...
>   TLB flush
> 
> Though thread B assumes the page has already been protected when it
> returns, the remaining TLB entry will break that assumption.
> 
> This patch fixes this problem by making get_dirty_log hold the mmu_lock
> until it flushes the TLB's.
> 
> Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
> ---
>  arch/x86/kvm/x86.c |   11 +++++------
>  1 files changed, 5 insertions(+), 6 deletions(-)

Applied, thanks.

Please don't forget the invalidate_page fix.