Re: [PATCH] mm: mmu_notifier: fix inconsistent memory between secondary MMU and host

Andrew Morton
2012-08-22T19:15:35Z

On Wed, 22 Aug 2012 18:29:55 +0200
Andrea Arcangeli <aarcange@redhat.com> wrote:

> On Wed, Aug 22, 2012 at 02:03:41PM +0800, Xiao Guangrong wrote:
> > On 08/21/2012 11:06 PM, Andrea Arcangeli wrote:
> > > CPU0 CPU1
> > > oldpage[1] == 0 (both guest & host)
> > > oldpage[0] = 1
> > > trigger do_wp_page
> >
> > We always do ptep_clear_flush before set_pte_at_notify(),
> > at this point, we have done:
> > pte = 0 and flush all tlbs
> > > mmu_notifier_change_pte
> > > spte = newpage + writable
> > > guest does newpage[1] = 1
> > > vmexit
> > > host read oldpage[1] == 0
> >
> > It can not happen, at this point pte = 0, host can not
> > access oldpage anymore, host read can generate #PF, it
> > will be blocked on page table lock until CPU 0 release the lock.
>
> Agreed, this is why your fix is safe.
>
> ...
>
> Thanks a lot for fixing this subtle race!

I'll take that as an ack.

Unfortunately we weren't told the user-visible effects of the bug,
which often makes it hard to determine which kernel versions should be
patched. Please do always provide this information when fixing a bug.