From: Paolo Bonzini <pbonzini@redhat.com>
To: Christian Borntraeger <borntraeger@de.ibm.com>,
David Stevens <stevensd@chromium.org>,
Marc Zyngier <maz@kernel.org>,
Huacai Chen <chenhuacai@kernel.org>,
Aleksandar Markovic <aleksandar.qemu.devel@gmail.com>,
Paul Mackerras <paulus@ozlabs.org>,
Nick Piggin <npiggin@gmail.com>
Cc: James Morse <james.morse@arm.com>,
Alexandru Elisei <alexandru.elisei@arm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Will Deacon <will@kernel.org>,
Sean Christopherson <seanjc@google.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
Zhenyu Wang <zhenyuw@linux.intel.com>,
Zhi Wang <zhi.a.wang@intel.com>,
linux-arm-kernel@lists.infradead.org,
kvmarm@lists.cs.columbia.edu, linux-kernel@vger.kernel.org,
linux-mips@vger.kernel.org, kvm@vger.kernel.org,
kvm-ppc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
intel-gvt-dev@lists.freedesktop.org,
intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org
Subject: Re: [PATCH v2 1/5] KVM: do not allow mapping valid but non-refcounted pages
Date: Fri, 25 Jun 2021 10:07:20 +0200 [thread overview]
Message-ID: <5e865b84-7b8f-bd2d-5e74-f46b257ad858@redhat.com> (raw)
In-Reply-To: <183b71c1-6bb0-8d05-e2ce-e452253259a8@de.ibm.com>
On 25/06/21 09:58, Christian Borntraeger wrote:
>
>
> On 25.06.21 09:36, David Stevens wrote:
>> From: Nicholas Piggin <npiggin@gmail.com>
>>
>> It's possible to create a region which maps valid but non-refcounted
>> pages (e.g., tail pages of non-compound higher order allocations). These
>> host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
>> of APIs, which take a reference to the page, which takes it from 0 to 1.
>> When the reference is dropped, this will free the page incorrectly.
>>
>> Fix this by only taking a reference on the page if it was non-zero,
>> which indicates it is participating in normal refcounting (and can be
>> released with put_page).
>>
>> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
>
> I guess this would be the small fix for stable? Do we want to add that cc?
>
> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Yes, this one is going to Linus today. The rest is for 5.15.
Paolo
>> ---
>> virt/kvm/kvm_main.c | 19 +++++++++++++++++--
>> 1 file changed, 17 insertions(+), 2 deletions(-)
>>
>> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
>> index 3dcc2abbfc60..f7445c3bcd90 100644
>> --- a/virt/kvm/kvm_main.c
>> +++ b/virt/kvm/kvm_main.c
>> @@ -2175,6 +2175,13 @@ static bool vma_is_valid(struct vm_area_struct
>> *vma, bool write_fault)
>> return true;
>> }
>>
>> +static int kvm_try_get_pfn(kvm_pfn_t pfn)
>> +{
>> + if (kvm_is_reserved_pfn(pfn))
>> + return 1;
>> + return get_page_unless_zero(pfn_to_page(pfn));
>> +}
>> +
>> static int hva_to_pfn_remapped(struct vm_area_struct *vma,
>> unsigned long addr, bool *async,
>> bool write_fault, bool *writable,
>> @@ -2224,13 +2231,21 @@ static int hva_to_pfn_remapped(struct
>> vm_area_struct *vma,
>> * Whoever called remap_pfn_range is also going to call e.g.
>> * unmap_mapping_range before the underlying pages are freed,
>> * causing a call to our MMU notifier.
>> + *
>> + * Certain IO or PFNMAP mappings can be backed with valid
>> + * struct pages, but be allocated without refcounting e.g.,
>> + * tail pages of non-compound higher order allocations, which
>> + * would then underflow the refcount when the caller does the
>> + * required put_page. Don't allow those pages here.
>> */
>> - kvm_get_pfn(pfn);
>> + if (!kvm_try_get_pfn(pfn))
>> + r = -EFAULT;
>>
>> out:
>> pte_unmap_unlock(ptep, ptl);
>> *p_pfn = pfn;
>> - return 0;
>> +
>> + return r;
>> }
>>
>> /*
>>
>
next prev parent reply other threads:[~2021-06-25 8:07 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-25 7:36 [PATCH v2 0/5] Remove uses of struct page from x86 and arm64 MMU David Stevens
2021-06-25 7:36 ` [PATCH v2 1/5] KVM: do not allow mapping valid but non-refcounted pages David Stevens
2021-06-25 7:58 ` Christian Borntraeger
2021-06-25 8:07 ` Paolo Bonzini [this message]
2021-06-25 7:36 ` [PATCH v2 2/5] KVM: mmu: introduce new gfn_to_pfn_page functions David Stevens
2021-06-25 7:36 ` [PATCH v2 3/5] KVM: x86/mmu: use gfn_to_pfn_page David Stevens
2021-06-25 7:36 ` [PATCH v2 4/5] KVM: arm64/mmu: " David Stevens
2021-06-25 7:36 ` [PATCH v2 5/5] KVM: mmu: remove over-aggressive warnings David Stevens
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5e865b84-7b8f-bd2d-5e74-f46b257ad858@redhat.com \
--to=pbonzini@redhat.com \
--cc=aleksandar.qemu.devel@gmail.com \
--cc=alexandru.elisei@arm.com \
--cc=borntraeger@de.ibm.com \
--cc=chenhuacai@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-gvt-dev@lists.freedesktop.org \
--cc=james.morse@arm.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm-ppc@vger.kernel.org \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=maz@kernel.org \
--cc=npiggin@gmail.com \
--cc=paulus@ozlabs.org \
--cc=seanjc@google.com \
--cc=stevensd@chromium.org \
--cc=suzuki.poulose@arm.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=will@kernel.org \
--cc=zhenyuw@linux.intel.com \
--cc=zhi.a.wang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).