From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1169838AbdDXM1M (ORCPT ); Mon, 24 Apr 2017 08:27:12 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:38019 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1169444AbdDXM1C (ORCPT ); Mon, 24 Apr 2017 08:27:02 -0400 Date: Mon, 24 Apr 2017 14:27:01 +0200 From: Christoffer Dall To: Suzuki K Poulose Cc: pbonzini@redhat.com, christoffer.dall@linaro.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, andreyknvl@google.com, rkrcmar@redhat.com Subject: Re: [PATCH 2/2] kvm: arm/arm64: Fix race in resetting stage2 PGD Message-ID: <20170424122701.GI4104@cbox> References: <1493028624-29837-1-git-send-email-suzuki.poulose@arm.com> <1493028624-29837-3-git-send-email-suzuki.poulose@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1493028624-29837-3-git-send-email-suzuki.poulose@arm.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Apr 24, 2017 at 11:10:24AM +0100, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we check the stage2 PGD before holding > the lock and proceed to take the lock if it is valid. And we unmap > the page tables, followed by releasing the lock. We reset the PGD > only after dropping this lock, which could cause a race condition > where another thread waiting on the lock could potentially see that > the PGD is still valid and proceed to perform a stage2 operation. > > This patch moves the stage2 PGD manipulation under the lock. > > Reported-by: Alexander Graf > Cc: Christoffer Dall > Cc: Marc Zyngier > Cc: Paolo Bonzini > Signed-off-by: Suzuki K Poulose Reviewed-by: Christoffer Dall > --- > arch/arm/kvm/mmu.c | 14 ++++++++------ > 1 file changed, 8 insertions(+), 6 deletions(-) > > diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c > index 582a972..9c4026d 100644 > --- a/arch/arm/kvm/mmu.c > +++ b/arch/arm/kvm/mmu.c > @@ -835,16 +835,18 @@ void stage2_unmap_vm(struct kvm *kvm) > */ > void kvm_free_stage2_pgd(struct kvm *kvm) > { > - if (kvm->arch.pgd == NULL) > - return; > + void *pgd = NULL; > > spin_lock(&kvm->mmu_lock); > - unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + if (kvm->arch.pgd) { > + unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); > + pgd = kvm->arch.pgd; > + kvm->arch.pgd = NULL; > + } > spin_unlock(&kvm->mmu_lock); > - > /* Free the HW pgd, one page at a time */ > - free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE); > - kvm->arch.pgd = NULL; > + if (pgd) > + free_pages_exact(pgd, S2_PGD_SIZE); > } > > static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache, > -- > 2.7.4 >