From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AAB2ECAAD5 for ; Tue, 6 Sep 2022 15:25:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237767AbiIFPZH (ORCPT ); Tue, 6 Sep 2022 11:25:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233941AbiIFPYg (ORCPT ); Tue, 6 Sep 2022 11:24:36 -0400 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E664BD4CB for ; Tue, 6 Sep 2022 07:36:18 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id u9so23772555ejy.5 for ; Tue, 06 Sep 2022 07:36:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=p8gTx3uOF4/ovmXPFVRTuzyCMLlLLhT4cULIky1/IL8+iHMHN/Vt9kisTT0x13y5y6 1JrMubmWdS3RiAIdUBO3BzsfLe93IIXY2jVDIsDfOzVyq86Dk+K8V2v9nl1aYoEDOqzO v4BmSEkFlehCfvhThoWnOBq4wXZLuZG4tGqjgg3iQIBi2WhnLil3QOGlU+jcm0dvTxdb FBDNP3wkiukuDA9WlvUR289cSqbCdxmcqmidlmPrHl0GKV9BhrStliKQ0zbklVtzcvVg bW9RYHZlO/Ymx1i7ZL2HN7OGRdn6pV+RqJ6HLVkZg4niM2nbzxR7mHgCEEiZeD8UW7ET nBAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=gLhtYEQHzgXxk54az96X8XSWfGFEbs2ykE3rsKcKZS0jZ4dZLAFlL/V1LX22Hret0j 5b11bsV5qxgVt+R/eBzMsQCcJeDtHxsgO42eIm6KGTKa743KXUC7+DNyXiQckdQ0IctS uZAmIg6i2G/pEw3xBE8O7ZymtRkdcAoHDbq7zw8DUJh/5Nu+IqRq/dTbr3Dm4CvV1t7u HunwBf0tcdDOdBXMo7L00I/h8yDdRa/GR9aHF9D3dz8M2L+0dt0Mddzn9oIwCX9cU31q GMdl841OxrdcCzhfm18yKfcudWcyE32bX4cDo4h2Ea/tcEb4klzrPAMwH8TVePkTSyTm tlTA== X-Gm-Message-State: ACgBeo2XSXoYtU7GcorJec9XebtTXPZy46mLK0QlyaJxPqmzhAhswRt9 GO/MO5ifXEmsc0OtHXPRnEcVnA== X-Google-Smtp-Source: AA6agR5np46sPXKIJ6mj4xhD1w/LSNMP/pZ9ZrZilKDS7z6Q4hPFRehMAa3RPeEVWH2GeFCQf1WWwQ== X-Received: by 2002:a17:907:2cd4:b0:73c:9fa8:3ddc with SMTP id hg20-20020a1709072cd400b0073c9fa83ddcmr30463131ejc.40.1662474950709; Tue, 06 Sep 2022 07:35:50 -0700 (PDT) Received: from google.com (64.227.90.34.bc.googleusercontent.com. [34.90.227.64]) by smtp.gmail.com with ESMTPSA id h41-20020a0564020ea900b0044629b54b00sm8561495eda.46.2022.09.06.07.35.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Sep 2022 07:35:49 -0700 (PDT) Date: Tue, 6 Sep 2022 14:35:47 +0000 From: Quentin Perret To: Oliver Upton Cc: Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , Catalin Marinas , Will Deacon , Ricardo Koller , Reiji Watanabe , David Matlack , Ben Gardon , Paolo Bonzini , Gavin Shan , Peter Xu , Sean Christopherson , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 02/14] KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make Message-ID: References: <20220830194132.962932-1-oliver.upton@linux.dev> <20220830194132.962932-3-oliver.upton@linux.dev> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220830194132.962932-3-oliver.upton@linux.dev> Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Hi Oliver, On Tuesday 30 Aug 2022 at 19:41:20 (+0000), Oliver Upton wrote: > static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > kvm_pte_t *ptep, > struct stage2_map_data *data) > { > - if (data->anchor) > - return 0; > + struct kvm_pgtable_mm_ops *mm_ops = data->mm_ops; > + kvm_pte_t *childp = kvm_pte_follow(*ptep, mm_ops); > + struct kvm_pgtable *pgt = data->mmu->pgt; > + int ret; > > if (!stage2_leaf_mapping_allowed(addr, end, level, data)) > return 0; > > - data->childp = kvm_pte_follow(*ptep, data->mm_ops); > kvm_clear_pte(ptep); > > /* > @@ -782,8 +786,13 @@ static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > * individually. > */ > kvm_call_hyp(__kvm_tlb_flush_vmid, data->mmu); > - data->anchor = ptep; > - return 0; > + > + ret = stage2_map_walk_leaf(addr, end, level, ptep, data); > + > + mm_ops->put_page(ptep); > + mm_ops->free_removed_table(childp, level + 1, pgt); By the look of it, __kvm_pgtable_visit() has saved the table PTE on the stack prior to calling the TABLE_PRE callback, and it then uses the PTE from its stack and does kvm_pte_follow() to find the childp, and walks from there. Would that be a UAF now? > + return ret; > }