Re: [PATCH] KVM: MMU: Fix rmap_remove() race

[Andi Kleen <andi@firstfloor.org>]

Avi Kivity <avi@qumranet.com> writes:

(thought i sent a reply before, but i don't see it now. sorry if you
see it twice)

> Andrea notes that freeing the page before flushing the tlb is a race, as the
> guest can sneak in one last write before the tlb is flushed, writing to a
> page that may belong to someone else.
> 
> Fix be reversing the order of freeing and flushing the tlb.  Since the tlb
> flush is expensive, queue the pages to be freed so we need to flush just once.

You have to do the same for the page tables too, because several modern
CPUs cache the higher level of the page tables and only invalidate the
cache on any TLB flush. Strictly it is only needed for the higher levels,
but doing it for all is safer.

-Andi

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace