KVM Archive on lore.kernel.org
 help / color / Atom feed
From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Peter Xu <peterx@redhat.com>
Cc: "James Hogan" <jhogan@kernel.org>,
	"Paul Mackerras" <paulus@ozlabs.org>,
	"Christian Borntraeger" <borntraeger@de.ibm.com>,
	"Janosch Frank" <frankja@linux.ibm.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Marc Zyngier" <maz@kernel.org>,
	linux-arm-kernel@lists.infradead.org,
	"Wanpeng Li" <wanpengli@tencent.com>,
	"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	kvm@vger.kernel.org, "David Hildenbrand" <david@redhat.com>,
	"Joerg Roedel" <joro@8bytes.org>,
	"Cornelia Huck" <cohuck@redhat.com>,
	linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org,
	kvm-ppc@vger.kernel.org, "Vitaly Kuznetsov" <vkuznets@redhat.com>,
	kvmarm@lists.cs.columbia.edu, "Jim Mattson" <jmattson@google.com>
Subject: Re: [PATCH v4 07/19] KVM: Explicitly free allocated-but-unused dirty bitmap
Date: Tue, 17 Dec 2019 14:51:18 -0800
Message-ID: <20191217225118.GF11771@linux.intel.com> (raw)
In-Reply-To: <20191217222446.GK7258@xz-x1>

On Tue, Dec 17, 2019 at 05:24:46PM -0500, Peter Xu wrote:
> On Tue, Dec 17, 2019 at 12:40:29PM -0800, Sean Christopherson wrote:
> > Explicitly free an allocated-but-unused dirty bitmap instead of relying
> > on kvm_free_memslot() if an error occurs in __kvm_set_memory_region().
> > There is no longer a need to abuse kvm_free_memslot() to free arch
> > specific resources as arch specific code is now called only after the
> > common flow is guaranteed to succeed.  Arch code can still fail, but
> > it's responsible for its own cleanup in that case.
> > 
> > Eliminating the error path's abuse of kvm_free_memslot() paves the way
> > for simplifying kvm_free_memslot(), i.e. dropping its @dont param.
> > 
> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> > ---
> >  virt/kvm/kvm_main.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index d403e93e3028..6b2261a9e139 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -1096,7 +1096,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
> >  
> >  	slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL_ACCOUNT);
> >  	if (!slots)
> > -		goto out_free;
> > +		goto out_bitmap;
> >  	memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
> >  
> >  	if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
> > @@ -1144,8 +1144,9 @@ int __kvm_set_memory_region(struct kvm *kvm,
> >  	if (change == KVM_MR_DELETE || change == KVM_MR_MOVE)
> >  		slots = install_new_memslots(kvm, as_id, slots);
> >  	kvfree(slots);
> > -out_free:
> > -	kvm_free_memslot(kvm, &new, &old);
> > +out_bitmap:
> > +	if (new.dirty_bitmap && !old.dirty_bitmap)
> > +		kvm_destroy_dirty_bitmap(&new);
> 
> What if both the old and new have KVM_MEM_LOG_DIRTY_PAGES set?
> kvm_free_memslot() did cover that but I see that you explicitly
> dropped it.  Could I ask why?  Thanks,

In that case, old.dirty_bitmap == new.dirty_bitmap, i.e. shouldn't be freed
by this error path since doing so would result in a use-after-free via the
old memslot.

The kvm_free_memslot() logic is the same, albeit in a very twisted way.

In __kvm_set_memory_region(), @old and @new start with the same dirty_bitmap.

	new = old = *slot;

And @new is modified based on KVM_MEM_LOG_DIRTY_PAGES.  If LOG_DIRTY_PAGES
is set in both @new and @old, then both the "if" and "else if" evaluate
false, i.e. new.dirty_bitmap == old.dirty_bitmap.

	/* Allocate/free page dirty bitmap as needed */
	if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
		new.dirty_bitmap = NULL;
	else if (!new.dirty_bitmap) {
		r = kvm_create_dirty_bitmap(&new);
		if (r)
			return r;
	}

Subbing "@free <= @new" and "@dont <= @old" in kvm_free_memslot()

  static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
			       struct kvm_memory_slot *dont)
  {
	if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
		kvm_destroy_dirty_bitmap(free);


yeids this, since @old is obviously non-NULL

	if (new.dirty_bitmap != old.dirty_bitmap)
		kvm_destroy_dirty_bitmap(&new);

The dirty_bitmap allocation logic guarantees that new.dirty_bitmap is
  a) NULL (the "if" case")
  b) != old.dirty_bitmap iff old.dirty_bitmap == NULL (the "else if" case)
  c) == old.dirty_bitmap (the implicit "else" case).

kvm_free_memslot() frees @new.dirty_bitmap iff its != @old.dirty_bitmap,
thus the explicit destroy only needs to check for (b).

  reply index

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-17 20:40 [PATCH v4 00/19] KVM: Dynamically size memslot arrays Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 01/19] KVM: x86: Allocate new rmap and large page tracking when moving memslot Sean Christopherson
2019-12-17 20:48   ` Sean Christopherson
2019-12-17 20:50     ` Sean Christopherson
2019-12-17 21:56   ` Peter Xu
2019-12-17 22:20     ` Sean Christopherson
2019-12-17 22:37       ` Peter Xu
2019-12-17 20:40 ` [PATCH v4 02/19] KVM: Reinstall old memslots if arch preparation fails Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 03/19] KVM: Don't free new memslot if allocation of said memslot fails Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 04/19] KVM: PPC: Move memslot memory allocation into prepare_memory_region() Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 05/19] KVM: x86: Allocate memslot resources during prepare_memory_region() Sean Christopherson
2019-12-17 22:07   ` Peter Xu
2019-12-17 20:40 ` [PATCH v4 06/19] KVM: Drop kvm_arch_create_memslot() Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 07/19] KVM: Explicitly free allocated-but-unused dirty bitmap Sean Christopherson
2019-12-17 22:24   ` Peter Xu
2019-12-17 22:51     ` Sean Christopherson [this message]
2019-12-18 16:17       ` Peter Xu
2019-12-17 20:40 ` [PATCH v4 08/19] KVM: Refactor error handling for setting memory region Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 09/19] KVM: Move setting of memslot into helper routine Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 10/19] KVM: Drop "const" attribute from old memslot in commit_memory_region() Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 11/19] KVM: x86: Free arrays for old memslot when moving memslot's base gfn Sean Christopherson
2019-12-17 22:48   ` Peter Xu
2019-12-17 20:40 ` [PATCH v4 12/19] KVM: Move memslot deletion to helper function Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 13/19] KVM: Simplify kvm_free_memslot() and all its descendents Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 14/19] KVM: Clean up local variable usage in __kvm_set_memory_region() Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 15/19] KVM: Provide common implementation for generic dirty log functions Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 16/19] KVM: Ensure validity of memslot with respect to kvm_get_dirty_log() Sean Christopherson
2019-12-24 18:19   ` Peter Xu
2020-01-14 18:25     ` Sean Christopherson
2020-02-06 22:03       ` Peter Xu
2020-02-07 18:52         ` Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 17/19] KVM: Terminate memslot walks via used_slots Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 18/19] KVM: Dynamically size memslot array based on number of used slots Sean Christopherson
2019-12-17 20:40 ` [PATCH v4 19/19] KVM: selftests: Add test for KVM_SET_USER_MEMORY_REGION Sean Christopherson
2019-12-18 11:29   ` Christian Borntraeger
2019-12-18 11:39   ` Christian Borntraeger
2019-12-18 16:39     ` Sean Christopherson
2019-12-18 11:40 ` [PATCH v4 00/19] KVM: Dynamically size memslot arrays Christian Borntraeger
2019-12-18 18:10 ` Marc Zyngier

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191217225118.GF11771@linux.intel.com \
    --to=sean.j.christopherson@intel.com \
    --cc=borntraeger@de.ibm.com \
    --cc=cohuck@redhat.com \
    --cc=david@redhat.com \
    --cc=f4bug@amsat.org \
    --cc=frankja@linux.ibm.com \
    --cc=jhogan@kernel.org \
    --cc=jmattson@google.com \
    --cc=joro@8bytes.org \
    --cc=kvm-ppc@vger.kernel.org \
    --cc=kvm@vger.kernel.org \
    --cc=kvmarm@lists.cs.columbia.edu \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mips@vger.kernel.org \
    --cc=maz@kernel.org \
    --cc=paulus@ozlabs.org \
    --cc=pbonzini@redhat.com \
    --cc=peterx@redhat.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

KVM Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/kvm/0 kvm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kvm kvm/ https://lore.kernel.org/kvm \
		kvm@vger.kernel.org
	public-inbox-index kvm

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.kvm


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git