From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nitesh Narayan Lal Subject: Re: [RFC][Patch v8 4/7] KVM: Disabling page poisoning to prevent corruption Date: Thu, 7 Feb 2019 12:56:37 -0500 Message-ID: <97de9a69-fb19-3e9e-d88d-b5b8219b0d9f@redhat.com> References: <20190204201854.2328-1-nitesh@redhat.com> <20190204201854.2328-5-nitesh@redhat.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="j6E1ImAeesDDqkyjqyFiwxKCfhIsh3Ow0" Cc: kvm list , LKML , Paolo Bonzini , lcapitulino@redhat.com, pagupta@redhat.com, wei.w.wang@intel.com, Yang Zhang , riel@surriel.com, david@redhat.com, "Michael S. Tsirkin" , dodgen@google.com, Konrad Rzeszutek Wilk , dhildenb@redhat.com, Andrea Arcangeli To: Alexander Duyck Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --j6E1ImAeesDDqkyjqyFiwxKCfhIsh3Ow0 Content-Type: multipart/mixed; boundary="BTHtnbsw0M4wX6IA1ZtPswxBSUT5LLRAY"; protected-headers="v1" From: Nitesh Narayan Lal To: Alexander Duyck Cc: kvm list , LKML , Paolo Bonzini , lcapitulino@redhat.com, pagupta@redhat.com, wei.w.wang@intel.com, Yang Zhang , riel@surriel.com, david@redhat.com, "Michael S. Tsirkin" , dodgen@google.com, Konrad Rzeszutek Wilk , dhildenb@redhat.com, Andrea Arcangeli Message-ID: <97de9a69-fb19-3e9e-d88d-b5b8219b0d9f@redhat.com> Subject: Re: [RFC][Patch v8 4/7] KVM: Disabling page poisoning to prevent corruption References: <20190204201854.2328-1-nitesh@redhat.com> <20190204201854.2328-5-nitesh@redhat.com> In-Reply-To: --BTHtnbsw0M4wX6IA1ZtPswxBSUT5LLRAY Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US On 2/7/19 12:23 PM, Alexander Duyck wrote: > On Mon, Feb 4, 2019 at 2:11 PM Nitesh Narayan Lal w= rote: >> This patch disables page poisoning if guest page hinting is enabled. >> It is required to avoid possible guest memory corruption errors. >> Page Poisoning is a feature in which the page is filled with a specifi= c >> pattern of (0x00 or 0xaa) after arch_free_page and the same is verifie= d >> before arch_alloc_page to prevent following issues: >> *information leak from the freed data >> *use after free bugs >> *memory corruption >> Selection of the pattern depends on the CONFIG_PAGE_POISONING_ZERO >> Once the guest pages which are supposed to be freed are sent to the >> hypervisor it frees them. After freeing the pages in the global list >> following things may happen: >> *Hypervisor reallocates the freed memory back to the guest >> *Hypervisor frees the memory and maps a different physical memory >> In order to prevent any information leak hypervisor before allocating >> memory to the guest fills it with zeroes. >> The issue arises when the pattern used for Page Poisoning is 0xaa whil= e >> the newly allocated page received from the hypervisor by the guest is >> filled with the pattern 0x00. This will result in memory corruption er= rors. >> >> Signed-off-by: Nitesh Narayan Lal > This seems kind of backwards to me. Why disable page poisoning instead > of just not hinting about the free pages? There shouldn't be that many > instances when page poisoning is enabled, and when it is it would make > more sense to leave it enabled rather than silently disable it. As I have mentioned in the cover email, I intend to reuse Wei's already merged work. This will enable the guest to communicate the poison value which is in use to the host. > >> --- >> include/linux/page_hinting.h | 8 ++++++++ >> mm/page_poison.c | 2 +- >> virt/kvm/page_hinting.c | 1 + >> 3 files changed, 10 insertions(+), 1 deletion(-) >> >> diff --git a/include/linux/page_hinting.h b/include/linux/page_hinting= =2Eh >> index 2d7ff59f3f6a..e800c6b07561 100644 >> --- a/include/linux/page_hinting.h >> +++ b/include/linux/page_hinting.h >> @@ -19,7 +19,15 @@ struct hypervisor_pages { >> extern int guest_page_hinting_flag; >> extern struct static_key_false guest_page_hinting_key; >> extern struct smp_hotplug_thread hinting_threads; >> +extern bool want_page_poisoning; >> >> int guest_page_hinting_sysctl(struct ctl_table *table, int write, >> void __user *buffer, size_t *lenp, loff_= t *ppos); >> void guest_free_page(struct page *page, int order); >> + >> +static inline void disable_page_poisoning(void) >> +{ >> +#ifdef CONFIG_PAGE_POISONING >> + want_page_poisoning =3D 0; >> +#endif >> +} >> diff --git a/mm/page_poison.c b/mm/page_poison.c >> index f0c15e9017c0..9af96021133b 100644 >> --- a/mm/page_poison.c >> +++ b/mm/page_poison.c >> @@ -7,7 +7,7 @@ >> #include >> #include >> >> -static bool want_page_poisoning __read_mostly; >> +bool want_page_poisoning __read_mostly; >> >> static int __init early_page_poison_param(char *buf) >> { >> diff --git a/virt/kvm/page_hinting.c b/virt/kvm/page_hinting.c >> index 636990e7fbb3..be529f6f2bc0 100644 >> --- a/virt/kvm/page_hinting.c >> +++ b/virt/kvm/page_hinting.c >> @@ -103,6 +103,7 @@ void guest_free_page(struct page *page, int order)= >> >> local_irq_save(flags); >> if (page_hinting_obj->kvm_pt_idx !=3D MAX_FGPT_ENTRIES) { >> + disable_page_poisoning(); >> page_hinting_obj->kvm_pt[page_hinting_obj->kvm_pt_idx]= =2Epfn =3D >> page_to_pfn(pa= ge); >> page_hinting_obj->kvm_pt[page_hinting_obj->kvm_pt_idx]= =2Ezonenum =3D > At a minimum it seems like you should have some sort of warning > message that you are disabling page poisoning rather than just > silently turning it off. --=20 Regards Nitesh --BTHtnbsw0M4wX6IA1ZtPswxBSUT5LLRAY-- --j6E1ImAeesDDqkyjqyFiwxKCfhIsh3Ow0 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEkXcoRVGaqvbHPuAGo4ZA3AYyozkFAlxccVUACgkQo4ZA3AYy ozluYRAAmHbZnwo/QtacGqYjvvgfUv2DVV0Zj8HE+JXQUmDZuwQWccAFaJVZMFK9 bcAolUit6YbgH/Kg3tMogrr0qS2HTg/cr77jSsZH/3ceYn4ZFsqJdHaIKsap/vb0 Rj+gVtFAZQ7CXJ+15sUF0eTjJvdbad7WBqtdro8FIS0sf7HmG7K1oGJ3npVI80Ef P8WqgJXmXflX7JSeUHACTzrYyaRylT6ftlJJ+d9GcoLeFVYGF6Dq7+diP2mE6VD+ /kR7kn4oBwTyFMbGdIUcJHfJAs3vnbnC0lbcW50N72Nd4uVkuNH6hVEFuXv+K6u8 v66Q5M3eAmh6kmgK4H7LcyX7jXVotiCPoJsdW1TCc+5G5XV7ic5S8QGcyIZaIBM2 r4Rq9jeGerRnkwuuZ6Tw20lnbdAzKX0EUf8KODAx/EBW7j4TK/ew1y+Xb3H6VPeG 8pJ0v+dIZXrsRmUVwzdW5bHdlWdf+SKEAnVjUyLS6VHahDT4pMhlvbG68yxlxjZo R0tfW5kXjV0+TNjRehvpD4tFfki1fDg0lnhJI97Wf6Cbct0D7111V5j26SzQHM5D Et6DPcmF3XK0+DQvof807rv6dNEP7AMTvFOlfO+tEnz3OvNdOtrlS3aq0adn0EED 6MtjUn5VJhU6z7ZGQvcItbw7FVFBKPvC86azruo7+5+J2+NkZp0= =CVGR -----END PGP SIGNATURE----- --j6E1ImAeesDDqkyjqyFiwxKCfhIsh3Ow0--