linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Roman Kagan <rkagan@virtuozzo.com>,
	Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH 4.17 20/31] kvm: x86: vmx: fix vpid leak
Date: Sat,  4 Aug 2018 11:00:55 +0200	[thread overview]
Message-ID: <20180804082633.855160204@linuxfoundation.org> (raw)
In-Reply-To: <20180804082632.304529527@linuxfoundation.org>

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roman Kagan <rkagan@virtuozzo.com>

commit 63aff65573d73eb8dda4732ad4ef222dd35e4862 upstream.

VPID for the nested vcpu is allocated at vmx_create_vcpu whenever nested
vmx is turned on with the module parameter.

However, it's only freed if the L1 guest has executed VMXON which is not
a given.

As a result, on a system with nested==on every creation+deletion of an
L1 vcpu without running an L2 guest results in leaking one vpid.  Since
the total number of vpids is limited to 64k, they can eventually get
exhausted, preventing L2 from starting.

Delay allocation of the L2 vpid until VMXON emulation, thus matching its
freeing.

Fixes: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0
Cc: stable@vger.kernel.org
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/vmx.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7660,6 +7660,8 @@ static int enter_vmx_operation(struct kv
 		     HRTIMER_MODE_REL_PINNED);
 	vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
 
+	vmx->nested.vpid02 = allocate_vpid();
+
 	vmx->nested.vmxon = true;
 	return 0;
 
@@ -10108,11 +10110,9 @@ static struct kvm_vcpu *vmx_create_vcpu(
 			goto free_vmcs;
 	}
 
-	if (nested) {
+	if (nested)
 		nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
 					   kvm_vcpu_apicv_active(&vmx->vcpu));
-		vmx->nested.vpid02 = allocate_vpid();
-	}
 
 	vmx->nested.posted_intr_nv = -1;
 	vmx->nested.current_vmptr = -1ull;
@@ -10129,7 +10129,6 @@ static struct kvm_vcpu *vmx_create_vcpu(
 	return &vmx->vcpu;
 
 free_vmcs:
-	free_vpid(vmx->nested.vpid02);
 	free_loaded_vmcs(vmx->loaded_vmcs);
 free_msrs:
 	kfree(vmx->guest_msrs);



  parent reply	other threads:[~2018-08-04  9:03 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-08-04  9:00 [PATCH 4.17 00/31] 4.17.13-stable review Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 01/31] bonding: avoid lockdep confusion in bond_get_stats() Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 02/31] inet: frag: enforce memory limits earlier Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 03/31] ipv4: frags: handle possible skb truesize change Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 04/31] net: dsa: Do not suspend/resume closed slave_dev Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 05/31] netlink: Fix spectre v1 gadget in netlink_create() Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 06/31] net: stmmac: Fix WoL for PCI-based setups Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 07/31] rxrpc: Fix user call ID check in rxrpc_service_prealloc_one Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 08/31] net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 09/31] net/mlx5e: Set port trust mode to PCP as default Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 10/31] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 11/31] squashfs: more metadata hardening Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 13/31] can: ems_usb: Fix memory leak on ems_usb_disconnect() Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 14/31] net: socket: fix potential spectre v1 gadget in socketcall Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 15/31] net: socket: Fix potential spectre v1 gadget in sock_is_registered Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 16/31] virtio_balloon: fix another race between migration and ballooning Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 17/31] x86/efi: Access EFI MMIO data as unencrypted when SEV is active Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 18/31] x86/apic: Future-proof the TSC_DEADLINE quirk for SKX Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 19/31] x86/entry/64: Remove %ebx handling from error_entry/exit Greg Kroah-Hartman
2018-08-04  9:00 ` Greg Kroah-Hartman [this message]
2018-08-04  9:00 ` [PATCH 4.17 21/31] audit: fix potential null dereference context->module.name Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 23/31] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails Greg Kroah-Hartman
2018-08-04  9:00 ` [PATCH 4.17 24/31] iwlwifi: add more card IDs for 9000 series Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 26/31] RDMA/uverbs: Expand primary and alt AV port checks Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 27/31] crypto: padlock-aes - Fix Nano workaround data corruption Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 28/31] drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 29/31] drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check() Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 30/31] drm/atomic: Initialize variables in drm_atomic_helper_async_check() to make gcc happy Greg Kroah-Hartman
2018-08-04  9:01 ` [PATCH 4.17 31/31] scsi: sg: fix minor memory leak in error path Greg Kroah-Hartman
2018-08-04 14:49 ` [PATCH 4.17 00/31] 4.17.13-stable review Guenter Roeck
2018-08-05  6:54   ` Greg Kroah-Hartman
2018-08-05 11:50 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180804082633.855160204@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=rkagan@virtuozzo.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).