stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/2] KVM: fix overflow of zero page refcount with ksm running
@ 2020-04-01 12:50 Zhuang Yanying
  2020-04-01 12:50 ` [PATCH 1/2] " Zhuang Yanying
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: Zhuang Yanying @ 2020-04-01 12:50 UTC (permalink / raw)
  To: pbonzini, greg; +Cc: tv, stable, LinFeng

From: LinFeng <linfeng23@huawei.com>

We found that the !is_zero_page() in kvm_is_mmio_pfn() was
submmited in commit:90cff5a8cc("KVM: check for !is_zero_pfn() in
kvm_is_mmio_pfn()"), but reverted in commit:0ef2459983("kvm: fix
kvm_is_mmio_pfn() and rename to kvm_is_reserved_pfn()").

Maybe just adding !is_zero_page() to kvm_is_reserved_pfn() is too
rough. According to commit:e433e83bc3("KVM: MMU: Do not treat
ZONE_DEVICE pages as being reserved"), special handling in some
other flows is also need by zero_page, if we would treat zero_page
as being reserved.

Well, as fixing all functions reference to kvm_is_reserved_pfn() in
this patch, we found that only kvm_release_pfn_clean() and
kvm_get_pfn() don't need special handling.

So, we thought why not only check is_zero_page() in before get and
put page, and revert our last commit:31e813f38f("KVM: fix overflow
of zero page refcount with ksm running") in master.
Instead of adding !is_zero_page() in kvm_is_reserved_pfn(),
new idea is as follow:

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7f9ee2929cfe..f9a1f9cf188e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1695,7 +1695,8 @@ EXPORT_SYMBOL_GPL(kvm_release_page_clean);

 void kvm_release_pfn_clean(kvm_pfn_t pfn)
 {
-	if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn))
+	if (!is_error_noslot_pfn(pfn) &&
+	    (!kvm_is_reserved_pfn(pfn) || is_zero_pfn(pfn)))
 		put_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
@@ -1734,7 +1735,7 @@ EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);

 void kvm_get_pfn(kvm_pfn_t pfn)
 {
-	if (!kvm_is_reserved_pfn(pfn))
+	if (!kvm_is_reserved_pfn(pfn) || is_zero_pfn(pfn))
 		get_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_get_pfn);

We are confused why ZONE_DEVICE not do this, but treating it as
no reserved. Is it racy if we change only use the patch in cover letter,
but not the series patches.

And we check the code of v4.9.y v4.10.y v4.11.y v4.12.y, this bug exists
in v4.11.y and later, but not in v4.9.y v4.10.y or before.
After commit:e86c59b1b1("mm/ksm: improve deduplication of zero pages
with colouring"), ksm will use zero pages with colouring. This feature
was added in v4.11.y, so I wonder why v4.9.y has this bug.

We use crash tools attaching to /proc/kcore to check the refcount of
zero_page, then create and destroy vm. The refcount stays at 1 on v4.9.y,
well it increases only after v4.11.y. Are you sure it is the same bug
you run into? Is there something we missing?

LinFeng (1):
  KVM: special handling of zero_page in some flows

Zhuang Yanying (1):
  KVM: fix overflow of zero page refcount with ksm running

 arch/x86/kvm/mmu.c  | 2 ++
 virt/kvm/kvm_main.c | 9 +++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

-- 
2.23.0



^ permalink raw reply related	[flat|nested] 8+ messages in thread
* Re: proposing 7df003c85218b5f for v5.5.y, v5.4.y, 4.19.y, v4.14.y, v4.9.y
@ 2020-03-26 18:04 Paolo Bonzini
  2020-03-30 13:32 ` [PATCH 0/2] KVM: fix overflow of zero page refcount with ksm running Zhuang Yanying
  0 siblings, 1 reply; 8+ messages in thread
From: Paolo Bonzini @ 2020-03-26 18:04 UTC (permalink / raw)
  To: Thomas Voegtle, stable; +Cc: Zhuang Yanying, LinFeng

On 26/03/20 18:43, Thomas Voegtle wrote:
> 
> Hello,
> 
> the following one line commit
> 
> commit 7df003c85218b5f5b10a7f6418208f31e813f38f
> Author: Zhuang Yanying <ann.zhuangyanying@huawei.com>
> Date:   Sat Oct 12 11:37:31 2019 +0800
> 
>     KVM: fix overflow of zero page refcount with ksm running
> 
> 
> applies cleanly to v5.5.y, v5.4.y, 4.19.y, v4.14.y and v4.9.y.
> 
> I actually ran into that bug on 4.9.y
> 
> Thanks in advance,
> 
>  Thomas
> 
> 
> 

Yes, indeed.  It's not a trivial backport though, so I prefer to do it
manually.  I can help with that, or with reviews if Yanying already has
patches ready.

Thanks,

Paolo


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-04-01 13:00 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-04-01 12:50 [PATCH 0/2] KVM: fix overflow of zero page refcount with ksm running Zhuang Yanying
2020-04-01 12:50 ` [PATCH 1/2] " Zhuang Yanying
2020-04-01 13:00   ` Greg KH
2020-04-01 12:50 ` [PATCH 2/2] KVM: special handling of zero_page in some flows Zhuang Yanying
2020-04-01 13:00   ` Greg KH
2020-04-01 13:00 ` [PATCH 0/2] KVM: fix overflow of zero page refcount with ksm running Greg KH
  -- strict thread matches above, loose matches on Subject: below --
2020-03-26 18:04 proposing 7df003c85218b5f for v5.5.y, v5.4.y, 4.19.y, v4.14.y, v4.9.y Paolo Bonzini
2020-03-30 13:32 ` [PATCH 0/2] KVM: fix overflow of zero page refcount with ksm running Zhuang Yanying
2020-03-30 13:40   ` Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).