From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752097AbdCOJWE (ORCPT ); Wed, 15 Mar 2017 05:22:04 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:37028 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751477AbdCOJWB (ORCPT ); Wed, 15 Mar 2017 05:22:01 -0400 Date: Wed, 15 Mar 2017 10:21:47 +0100 From: Christoffer Dall To: Suzuki K Poulose Cc: linux-arm-kernel@lists.infradead.org, andreyknvl@google.com, dvyukov@google.com, marc.zyngier@arm.com, christoffer.dall@linaro.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, kcc@google.com, syzkaller@googlegroups.com, will.deacon@arm.com, catalin.marinas@arm.com, pbonzini@redhat.com, mark.rutland@arm.com, ard.biesheuvel@linaro.org, stable@vger.kernel.org Subject: Re: [PATCH 3/3] kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd Message-ID: <20170315092147.GM1277@cbox> References: <1489503154-20705-1-git-send-email-suzuki.poulose@arm.com> <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 14, 2017 at 02:52:34PM +0000, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we don't hold the kvm->mmu_lock while calling > unmap_stage2_range() on the entire memory range for the guest. This could > cause problems with other callers (e.g, munmap on a memslot) trying to > unmap a range. > > Fixes: commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") > Cc: stable@vger.kernel.org # v3.10+ > Cc: Marc Zyngier > Cc: Christoffer Dall > Signed-off-by: Suzuki K Poulose > --- > arch/arm/kvm/mmu.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c > index 13b9c1f..b361f71 100644 > --- a/arch/arm/kvm/mmu.c > +++ b/arch/arm/kvm/mmu.c > @@ -831,7 +831,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm) > if (kvm->arch.pgd == NULL) > return; > > + spin_lock(&kvm->mmu_lock); > unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + spin_unlock(&kvm->mmu_lock); > + This ends up holding the spin lock for potentially quite a while, where we can do things like __flush_dcache_area(), which I think can fault. Is that valid? Thanks, -Christoffer > /* Free the HW pgd, one page at a time */ > free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE); > kvm->arch.pgd = NULL; > -- > 2.7.4 > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoffer Dall Subject: Re: [PATCH 3/3] kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd Date: Wed, 15 Mar 2017 10:21:47 +0100 Message-ID: <20170315092147.GM1277@cbox> References: <1489503154-20705-1-git-send-email-suzuki.poulose@arm.com> <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org, ard.biesheuvel@linaro.org, marc.zyngier@arm.com, andreyknvl@google.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org, kcc@google.com, syzkaller@googlegroups.com, dvyukov@google.com, catalin.marinas@arm.com, pbonzini@redhat.com, kvmarm@lists.cs.columbia.edu To: Suzuki K Poulose Return-path: Content-Disposition: inline In-Reply-To: <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu List-Id: kvm.vger.kernel.org On Tue, Mar 14, 2017 at 02:52:34PM +0000, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we don't hold the kvm->mmu_lock while calling > unmap_stage2_range() on the entire memory range for the guest. This could > cause problems with other callers (e.g, munmap on a memslot) trying to > unmap a range. > > Fixes: commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") > Cc: stable@vger.kernel.org # v3.10+ > Cc: Marc Zyngier > Cc: Christoffer Dall > Signed-off-by: Suzuki K Poulose > --- > arch/arm/kvm/mmu.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c > index 13b9c1f..b361f71 100644 > --- a/arch/arm/kvm/mmu.c > +++ b/arch/arm/kvm/mmu.c > @@ -831,7 +831,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm) > if (kvm->arch.pgd == NULL) > return; > > + spin_lock(&kvm->mmu_lock); > unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + spin_unlock(&kvm->mmu_lock); > + This ends up holding the spin lock for potentially quite a while, where we can do things like __flush_dcache_area(), which I think can fault. Is that valid? Thanks, -Christoffer > /* Free the HW pgd, one page at a time */ > free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE); > kvm->arch.pgd = NULL; > -- > 2.7.4 > From mboxrd@z Thu Jan 1 00:00:00 1970 From: cdall@linaro.org (Christoffer Dall) Date: Wed, 15 Mar 2017 10:21:47 +0100 Subject: [PATCH 3/3] kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd In-Reply-To: <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> References: <1489503154-20705-1-git-send-email-suzuki.poulose@arm.com> <1489503154-20705-4-git-send-email-suzuki.poulose@arm.com> Message-ID: <20170315092147.GM1277@cbox> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, Mar 14, 2017 at 02:52:34PM +0000, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we don't hold the kvm->mmu_lock while calling > unmap_stage2_range() on the entire memory range for the guest. This could > cause problems with other callers (e.g, munmap on a memslot) trying to > unmap a range. > > Fixes: commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") > Cc: stable at vger.kernel.org # v3.10+ > Cc: Marc Zyngier > Cc: Christoffer Dall > Signed-off-by: Suzuki K Poulose > --- > arch/arm/kvm/mmu.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c > index 13b9c1f..b361f71 100644 > --- a/arch/arm/kvm/mmu.c > +++ b/arch/arm/kvm/mmu.c > @@ -831,7 +831,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm) > if (kvm->arch.pgd == NULL) > return; > > + spin_lock(&kvm->mmu_lock); > unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + spin_unlock(&kvm->mmu_lock); > + This ends up holding the spin lock for potentially quite a while, where we can do things like __flush_dcache_area(), which I think can fault. Is that valid? Thanks, -Christoffer > /* Free the HW pgd, one page at a time */ > free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE); > kvm->arch.pgd = NULL; > -- > 2.7.4 >