Re: [PATCH] KVM: MMU: Fix rmap_remove() race

Andi Kleen
2008-03-27T15:26:01Z

Avi Kivity <avi@qumranet.com> writes:

(thought i sent a reply before, but i don't see it now. sorry if you
see it twice)

> Andrea notes that freeing the page before flushing the tlb is a race, as the
> guest can sneak in one last write before the tlb is flushed, writing to a
> page that may belong to someone else.
>
> Fix be reversing the order of freeing and flushing the tlb. Since the tlb
> flush is expensive, queue the pages to be freed so we need to flush just once.

You have to do the same for the page tables too, because several modern
CPUs cache the higher level of the page tables and only invalidate the
cache on any TLB flush. Strictly it is only needed for the higher levels,
but doing it for all is safer.

-Andi