From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96CDDC2BA15 for ; Fri, 3 Apr 2020 15:31:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6ACDF20721 for ; Fri, 3 Apr 2020 15:31:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="cwqJEDsX" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404305AbgDCPbJ (ORCPT ); Fri, 3 Apr 2020 11:31:09 -0400 Received: from us-smtp-delivery-1.mimecast.com ([207.211.31.120]:24259 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2404293AbgDCPbI (ORCPT ); Fri, 3 Apr 2020 11:31:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1585927867; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CD7baw1Qg+npMYnPmj7hxrzhNyYIW5i9m/6usTzXTDc=; b=cwqJEDsXUcuIEETxvUreLUlMinpydsnzhUIw3k+NvDOiaIi10P/WqGEQv/JD7qo9SuvjZ+ cK2ZALLY98lGdQFxqJq0nEM5miLn4wUh+B89X6HFmUN9yWR5DK+tNXuTv5xbFo6gHS6JCR BPSh1+hy6k7N9Yw+QWmMHvIT7UniVkU= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-279-E-MBlT1wM_yzRbhycaQEoQ-1; Fri, 03 Apr 2020 11:31:05 -0400 X-MC-Unique: E-MBlT1wM_yzRbhycaQEoQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 51C9B1005516; Fri, 3 Apr 2020 15:31:04 +0000 (UTC) Received: from t480s.redhat.com (ovpn-112-213.ams2.redhat.com [10.36.112.213]) by smtp.corp.redhat.com (Postfix) with ESMTP id 66B0D26DC4; Fri, 3 Apr 2020 15:31:02 +0000 (UTC) From: David Hildenbrand To: kvm@vger.kernel.org Cc: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, Vasily Gorbik , Heiko Carstens , Cornelia Huck , Janosch Frank , Christian Borntraeger , David Hildenbrand Subject: [PATCH v2 3/5] KVM: s390: vsie: Fix possible race when shadowing region 3 tables Date: Fri, 3 Apr 2020 17:30:48 +0200 Message-Id: <20200403153050.20569-4-david@redhat.com> In-Reply-To: <20200403153050.20569-1-david@redhat.com> References: <20200403153050.20569-1-david@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Content-Transfer-Encoding: quoted-printable Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We have to properly retry again by returning -EINVAL immediately in case somebody else instantiated the table concurrently. We missed to add the goto in this function only. The code now matches the other, similar shadowing functions. We are overwriting an existing region 2 table entry. All allocated pages are added to the crst_list to be freed later, so they are not lost forever. However, when unshadowing the region 2 table, we wouldn't trigge= r unshadowing of the original shadowed region 3 table that we replaced. It would get unshadowed when the original region 3 table is modified. As it'= s not connected to the page table hierarchy anymore, it's not going to get used anymore. However, for a limited time, this page table will stick around, so it's in some sense a temporary memory leak. Identified by manual code inspection. I don't think this classifies as stable material. Fixes: 998f637cc4b9 ("s390/mm: avoid races on region/segment/page table s= hadowing") Signed-off-by: David Hildenbrand --- arch/s390/mm/gmap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index b93dd54b234a..24ef30fb0833 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1844,6 +1844,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long = saddr, unsigned long r3t, goto out_free; } else if (*table & _REGION_ENTRY_ORIGIN) { rc =3D -EAGAIN; /* Race with shadow */ + goto out_free; } crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY); /* mark as invalid as long as the parent table is not protected */ --=20 2.25.1