From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C12D0C76186 for ; Wed, 17 Jul 2019 10:04:40 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 97A7F2077C for ; Wed, 17 Jul 2019 10:04:40 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 97A7F2077C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:55572 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hngnf-00080l-NC for qemu-devel@archiver.kernel.org; Wed, 17 Jul 2019 06:04:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:46716) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hngnS-0007cB-Ty for qemu-devel@nongnu.org; Wed, 17 Jul 2019 06:04:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hngnR-0006lR-4B for qemu-devel@nongnu.org; Wed, 17 Jul 2019 06:04:26 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36804) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hngnQ-0006kd-SZ; Wed, 17 Jul 2019 06:04:25 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5386E308FE8D; Wed, 17 Jul 2019 10:04:22 +0000 (UTC) Received: from [10.36.117.65] (ovpn-117-65.ams2.redhat.com [10.36.117.65]) by smtp.corp.redhat.com (Postfix) with ESMTP id 46D435DA34; Wed, 17 Jul 2019 10:04:16 +0000 (UTC) To: "Michael S. Tsirkin" References: <20190717084255.17173-1-david@redhat.com> <20190717054727-mutt-send-email-mst@kernel.org> From: David Hildenbrand Openpgp: preference=signencrypt Autocrypt: addr=david@redhat.com; prefer-encrypt=mutual; keydata= xsFNBFXLn5EBEAC+zYvAFJxCBY9Tr1xZgcESmxVNI/0ffzE/ZQOiHJl6mGkmA1R7/uUpiCjJ dBrn+lhhOYjjNefFQou6478faXE6o2AhmebqT4KiQoUQFV4R7y1KMEKoSyy8hQaK1umALTdL QZLQMzNE74ap+GDK0wnacPQFpcG1AE9RMq3aeErY5tujekBS32jfC/7AnH7I0v1v1TbbK3Gp XNeiN4QroO+5qaSr0ID2sz5jtBLRb15RMre27E1ImpaIv2Jw8NJgW0k/D1RyKCwaTsgRdwuK Kx/Y91XuSBdz0uOyU/S8kM1+ag0wvsGlpBVxRR/xw/E8M7TEwuCZQArqqTCmkG6HGcXFT0V9 PXFNNgV5jXMQRwU0O/ztJIQqsE5LsUomE//bLwzj9IVsaQpKDqW6TAPjcdBDPLHvriq7kGjt WhVhdl0qEYB8lkBEU7V2Yb+SYhmhpDrti9Fq1EsmhiHSkxJcGREoMK/63r9WLZYI3+4W2rAc UucZa4OT27U5ZISjNg3Ev0rxU5UH2/pT4wJCfxwocmqaRr6UYmrtZmND89X0KigoFD/XSeVv jwBRNjPAubK9/k5NoRrYqztM9W6sJqrH8+UWZ1Idd/DdmogJh0gNC0+N42Za9yBRURfIdKSb B3JfpUqcWwE7vUaYrHG1nw54pLUoPG6sAA7Mehl3nd4pZUALHwARAQABzSREYXZpZCBIaWxk ZW5icmFuZCA8ZGF2aWRAcmVkaGF0LmNvbT7CwX4EEwECACgFAljj9eoCGwMFCQlmAYAGCwkI BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEE3eEPcA/4Na5IIP/3T/FIQMxIfNzZshIq687qgG 8UbspuE/YSUDdv7r5szYTK6KPTlqN8NAcSfheywbuYD9A4ZeSBWD3/NAVUdrCaRP2IvFyELj xoMvfJccbq45BxzgEspg/bVahNbyuBpLBVjVWwRtFCUEXkyazksSv8pdTMAs9IucChvFmmq3 jJ2vlaz9lYt/lxN246fIVceckPMiUveimngvXZw21VOAhfQ+/sofXF8JCFv2mFcBDoa7eYob s0FLpmqFaeNRHAlzMWgSsP80qx5nWWEvRLdKWi533N2vC/EyunN3HcBwVrXH4hxRBMco3jvM m8VKLKao9wKj82qSivUnkPIwsAGNPdFoPbgghCQiBjBe6A75Z2xHFrzo7t1jg7nQfIyNC7ez MZBJ59sqA9EDMEJPlLNIeJmqslXPjmMFnE7Mby/+335WJYDulsRybN+W5rLT5aMvhC6x6POK z55fMNKrMASCzBJum2Fwjf/VnuGRYkhKCqqZ8gJ3OvmR50tInDV2jZ1DQgc3i550T5JDpToh dPBxZocIhzg+MBSRDXcJmHOx/7nQm3iQ6iLuwmXsRC6f5FbFefk9EjuTKcLMvBsEx+2DEx0E UnmJ4hVg7u1PQ+2Oy+Lh/opK/BDiqlQ8Pz2jiXv5xkECvr/3Sv59hlOCZMOaiLTTjtOIU7Tq 7ut6OL64oAq+zsFNBFXLn5EBEADn1959INH2cwYJv0tsxf5MUCghCj/CA/lc/LMthqQ773ga uB9mN+F1rE9cyyXb6jyOGn+GUjMbnq1o121Vm0+neKHUCBtHyseBfDXHA6m4B3mUTWo13nid 0e4AM71r0DS8+KYh6zvweLX/LL5kQS9GQeT+QNroXcC1NzWbitts6TZ+IrPOwT1hfB4WNC+X 2n4AzDqp3+ILiVST2DT4VBc11Gz6jijpC/KI5Al8ZDhRwG47LUiuQmt3yqrmN63V9wzaPhC+ xbwIsNZlLUvuRnmBPkTJwwrFRZvwu5GPHNndBjVpAfaSTOfppyKBTccu2AXJXWAE1Xjh6GOC 8mlFjZwLxWFqdPHR1n2aPVgoiTLk34LR/bXO+e0GpzFXT7enwyvFFFyAS0Nk1q/7EChPcbRb hJqEBpRNZemxmg55zC3GLvgLKd5A09MOM2BrMea+l0FUR+PuTenh2YmnmLRTro6eZ/qYwWkC u8FFIw4pT0OUDMyLgi+GI1aMpVogTZJ70FgV0pUAlpmrzk/bLbRkF3TwgucpyPtcpmQtTkWS gDS50QG9DR/1As3LLLcNkwJBZzBG6PWbvcOyrwMQUF1nl4SSPV0LLH63+BrrHasfJzxKXzqg rW28CTAE2x8qi7e/6M/+XXhrsMYG+uaViM7n2je3qKe7ofum3s4vq7oFCPsOgwARAQABwsFl BBgBAgAPBQJVy5+RAhsMBQkJZgGAAAoJEE3eEPcA/4NagOsP/jPoIBb/iXVbM+fmSHOjEshl KMwEl/m5iLj3iHnHPVLBUWrXPdS7iQijJA/VLxjnFknhaS60hkUNWexDMxVVP/6lbOrs4bDZ NEWDMktAeqJaFtxackPszlcpRVkAs6Msn9tu8hlvB517pyUgvuD7ZS9gGOMmYwFQDyytpepo YApVV00P0u3AaE0Cj/o71STqGJKZxcVhPaZ+LR+UCBZOyKfEyq+ZN311VpOJZ1IvTExf+S/5 lqnciDtbO3I4Wq0ArLX1gs1q1XlXLaVaA3yVqeC8E7kOchDNinD3hJS4OX0e1gdsx/e6COvy qNg5aL5n0Kl4fcVqM0LdIhsubVs4eiNCa5XMSYpXmVi3HAuFyg9dN+x8thSwI836FoMASwOl C7tHsTjnSGufB+D7F7ZBT61BffNBBIm1KdMxcxqLUVXpBQHHlGkbwI+3Ye+nE6HmZH7IwLwV W+Ajl7oYF+jeKaH4DZFtgLYGLtZ1LDwKPjX7VAsa4Yx7S5+EBAaZGxK510MjIx6SGrZWBrrV TEvdV00F2MnQoeXKzD7O4WFbL55hhyGgfWTHwZ457iN9SgYi1JLPqWkZB0JRXIEtjd4JEQcx +8Umfre0Xt4713VxMygW0PnQt5aSQdMD58jHFxTk092mU+yIHj5LeYgvwSgZN4airXk5yRXl SE+xAvmumFBY Organization: Red Hat GmbH Message-ID: <5a5d6f86-04f2-4e61-473c-d8a4b0ed5045@redhat.com> Date: Wed, 17 Jul 2019 12:04:15 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <20190717054727-mutt-send-email-mst@kernel.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Wed, 17 Jul 2019 10:04:22 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: Re: [Qemu-devel] [PATCH-for-4.1] virtio-balloon: fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Igor Mammedov , David Gibson , qemu-devel@nongnu.org, Stefan Hajnoczi , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On 17.07.19 11:57, Michael S. Tsirkin wrote: > On Wed, Jul 17, 2019 at 10:42:55AM +0200, David Hildenbrand wrote: >> We are using the wrong functions to set/clear bits, effectively touchi= ng >> multiple bits, writing out of range of the bitmap, resulting in memory >> corruptions. We have to use set_bit()/clear_bit() instead. >> >> Can easily be reproduced by starting a qemu guest on hugetlbfs memory, >> inflating the balloon. QEMU crashes. This never could have worked >> properly - especially, also pages would have been discarded when the >> first sub-page would be inflated (the whole bitmap would be set). >> >> While testing I realized, that on hugetlbfs it is pretty much impossib= le >> to discard a page - the guest just frees the 4k sub-pages in random or= der >> most of the time. I was only able to discard a hugepage a handful of >> times - so I hope that now works correctly. >> >> Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE = < >> host page size") >> Fixes: b27b32391404 ("virtio-balloon: Fix possible guest memory corrup= tion >> with inflates & deflates") >> Cc: qemu-stable@nongnu.org #v4.0.0 >> Cc: Stefan Hajnoczi >> Cc: David Gibson >> Cc: Michael S. Tsirkin >> Cc: Igor Mammedov >> Signed-off-by: David Hildenbrand >> --- >> hw/virtio/virtio-balloon.c | 10 ++++------ >> 1 file changed, 4 insertions(+), 6 deletions(-) >> >> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c >> index e85d1c0d5c..669067d661 100644 >> --- a/hw/virtio/virtio-balloon.c >> +++ b/hw/virtio/virtio-balloon.c >> @@ -94,9 +94,8 @@ static void balloon_inflate_page(VirtIOBalloon *ball= oon, >> balloon->pbp->base =3D host_page_base; >> } >> =20 >> - bitmap_set(balloon->pbp->bitmap, >> - (ram_offset - balloon->pbp->base) / BALLOON_PAGE_SIZE, >> - subpages); >> + set_bit((ram_offset - balloon->pbp->base) / BALLOON_PAGE_SIZE, >> + balloon->pbp->bitmap); >> =20 >> if (bitmap_full(balloon->pbp->bitmap, subpages)) { >> /* We've accumulated a full host page, we can actually discar= d >> @@ -140,9 +139,8 @@ static void balloon_deflate_page(VirtIOBalloon *ba= lloon, >> * for a guest to do this in practice, but handle it anyway, >> * since getting it wrong could mean discarding memory the >> * guest is still using. */ >> - bitmap_clear(balloon->pbp->bitmap, >> - (ram_offset - balloon->pbp->base) / BALLOON_PAGE= _SIZE, >> - subpages); >> + clear_bit((ram_offset - balloon->pbp->base) / BALLOON_PAGE_SI= ZE, >> + balloon->pbp->bitmap); >> =20 >> if (bitmap_empty(balloon->pbp->bitmap, subpages)) { >> g_free(balloon->pbp); >=20 > I also started to wonder about this: >=20 > if (!balloon->pbp) { > /* Starting on a new host page */ > size_t bitlen =3D BITS_TO_LONGS(subpages) * sizeof(unsigned lon= g); > balloon->pbp =3D g_malloc0(sizeof(PartiallyBalloonedPage) + bit= len); > balloon->pbp->rb =3D rb; > balloon->pbp->base =3D host_page_base; > } >=20 > Is keeping a pointer to a ram block like this safe? what if the rambloc= k > gets removed? >=20 David added if (balloon->pbp && (rb !=3D balloon->pbp->rb ) ... So in case the rb changes (IOW replaced - delete old one, new one added), we reset the data. After a ram block was deleted, there will be no more deflation requests coming in for it. This should be fine I guess. However, there is another possible issue: Resets. If the balloon was inflated and we reboot, the old balloon->pbp will remain intact. The guest will continue using all memory until virtio-balloon guest driver comes up. If the stars align, it could happen that new inflation requests by the guests will result in a discard of a big chunk, although the guest is re-using some parts already again. We would have to reset balloon->pbp during virtio_balloon_device_reset(). --=20 Thanks, David / dhildenb