From: Paolo Bonzini <pbonzini@redhat.com>
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: seanjc@google.com, ignat@cloudflare.com, bgardon@google.com,
dmatlack@google.com, stevensd@chromium.org,
kernel-team@cloudflare.com
Subject: [PATCH 0/2] KVM: x86: Fix dangling page reference in TDP MMU
Date: Mon, 13 Dec 2021 06:25:12 -0500 [thread overview]
Message-ID: <20211213112514.78552-1-pbonzini@redhat.com> (raw)
kvm_tdp_mmu_zap_all is intended to visit all roots and zap their page
tables, which flushes the accessed and dirty bits out to the Linux
"struct page"s. Missing some of the roots has catastrophic effects,
because kvm_tdp_mmu_zap_all is called when the MMU notifier is being
removed and any PTEs left behind might become dangling by the time
kvm-arch_destroy_vm tears down the roots for good.
Unfortunately that is exactly what kvm_tdp_mmu_zap_all is doing: it
visits all roots via for_each_tdp_mmu_root_yield_safe, which in turn
uses kvm_tdp_mmu_get_root to skip invalid roots. If the current root is
invalid at the time of kvm_tdp_mmu_zap_all, its page tables will remain
in place but will later be zapped during kvm_arch_destroy_vm.
To fix this, ensure that kvm_tdp_mmu_zap_all goes over all
roots, including the invalid ones. The easiest way to do so is for
kvm_tdp_mmu_zap_all to do the same as kvm_mmu_zap_all_fast: invalidate
all roots, and then zap the invalid roots. The only difference is that
there is no need to go through tdp_mmu_zap_spte_atomic.
Paolo
Paolo Bonzini (2):
KVM: x86: allow kvm_tdp_mmu_zap_invalidated_roots with write-locked
mmu_lock
KVM: x86: zap invalid roots in kvm_tdp_mmu_zap_all
arch/x86/kvm/mmu/mmu.c | 2 +-
arch/x86/kvm/mmu/tdp_mmu.c | 42 ++++++++++++++++++++------------------
arch/x86/kvm/mmu/tdp_mmu.h | 2 +-
3 files changed, 24 insertions(+), 22 deletions(-)
--
2.31.1
next reply other threads:[~2021-12-13 11:25 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-13 11:25 Paolo Bonzini [this message]
2021-12-13 11:25 ` [PATCH 1/2] KVM: x86: allow kvm_tdp_mmu_zap_invalidated_roots with write-locked mmu_lock Paolo Bonzini
2021-12-13 11:25 ` [PATCH 2/2] KVM: x86: zap invalid roots in kvm_tdp_mmu_zap_all Paolo Bonzini
2021-12-13 16:36 ` Sean Christopherson
2021-12-14 19:45 ` Sean Christopherson
2021-12-13 13:43 ` [PATCH 0/2] KVM: x86: Fix dangling page reference in TDP MMU Ignat Korchagin
2021-12-13 15:06 ` Paolo Bonzini
2021-12-13 16:47 ` Sean Christopherson
2021-12-13 18:28 ` Paolo Bonzini
2021-12-13 19:44 ` Sean Christopherson
2021-12-13 20:18 ` Ignat Korchagin
2021-12-14 3:12 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211213112514.78552-1-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=bgardon@google.com \
--cc=dmatlack@google.com \
--cc=ignat@cloudflare.com \
--cc=kernel-team@cloudflare.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=seanjc@google.com \
--cc=stevensd@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.