From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoffer Dall Subject: Re: [PATCH 2/2] kvm: arm/arm64: Fix race in resetting stage2 PGD Date: Mon, 24 Apr 2017 14:27:01 +0200 Message-ID: <20170424122701.GI4104@cbox> References: <1493028624-29837-1-git-send-email-suzuki.poulose@arm.com> <1493028624-29837-3-git-send-email-suzuki.poulose@arm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 3BD1440DF9 for ; Mon, 24 Apr 2017 08:24:16 -0400 (EDT) Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QdKpGiNPqX4p for ; Mon, 24 Apr 2017 08:24:14 -0400 (EDT) Received: from mail-wm0-f52.google.com (mail-wm0-f52.google.com [74.125.82.52]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id C679340DE0 for ; Mon, 24 Apr 2017 08:24:14 -0400 (EDT) Received: by mail-wm0-f52.google.com with SMTP id u65so21514959wmu.1 for ; Mon, 24 Apr 2017 05:27:02 -0700 (PDT) Content-Disposition: inline In-Reply-To: <1493028624-29837-3-git-send-email-suzuki.poulose@arm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu To: Suzuki K Poulose Cc: kvm@vger.kernel.org, marc.zyngier@arm.com, andreyknvl@google.com, linux-kernel@vger.kernel.org, pbonzini@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org List-Id: kvmarm@lists.cs.columbia.edu On Mon, Apr 24, 2017 at 11:10:24AM +0100, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we check the stage2 PGD before holding > the lock and proceed to take the lock if it is valid. And we unmap > the page tables, followed by releasing the lock. We reset the PGD > only after dropping this lock, which could cause a race condition > where another thread waiting on the lock could potentially see that > the PGD is still valid and proceed to perform a stage2 operation. > > This patch moves the stage2 PGD manipulation under the lock. > > Reported-by: Alexander Graf > Cc: Christoffer Dall > Cc: Marc Zyngier > Cc: Paolo Bonzini > Signed-off-by: Suzuki K Poulose Reviewed-by: Christoffer Dall > --- > arch/arm/kvm/mmu.c | 14 ++++++++------ > 1 file changed, 8 insertions(+), 6 deletions(-) > > diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c > index 582a972..9c4026d 100644 > --- a/arch/arm/kvm/mmu.c > +++ b/arch/arm/kvm/mmu.c > @@ -835,16 +835,18 @@ void stage2_unmap_vm(struct kvm *kvm) > */ > void kvm_free_stage2_pgd(struct kvm *kvm) > { > - if (kvm->arch.pgd == NULL) > - return; > + void *pgd = NULL; > > spin_lock(&kvm->mmu_lock); > - unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + if (kvm->arch.pgd) { > + unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + pgd = kvm->arch.pgd; > + kvm->arch.pgd = NULL; > + } > spin_unlock(&kvm->mmu_lock); > - > /* Free the HW pgd, one page at a time */ > - free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE); > - kvm->arch.pgd = NULL; > + if (pgd) > + free_pages_exact(pgd, S2_PGD_SIZE); > } > > static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache, > -- > 2.7.4 >