From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: David Hildenbrand <david@redhat.com>,
Claudio Imbrenda <imbrenda@linux.ibm.com>,
Christian Borntraeger <borntraeger@de.ibm.com>,
Sasha Levin <sashal@kernel.org>,
kvm@vger.kernel.org, linux-s390@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 14/21] KVM: s390: vsie: Fix possible race when shadowing region 3 tables
Date: Wed, 15 Apr 2020 07:47:41 -0400 [thread overview]
Message-ID: <20200415114748.15713-14-sashal@kernel.org> (raw)
In-Reply-To: <20200415114748.15713-1-sashal@kernel.org>
From: David Hildenbrand <david@redhat.com>
[ Upstream commit 1493e0f944f3c319d11e067c185c904d01c17ae5 ]
We have to properly retry again by returning -EINVAL immediately in case
somebody else instantiated the table concurrently. We missed to add the
goto in this function only. The code now matches the other, similar
shadowing functions.
We are overwriting an existing region 2 table entry. All allocated pages
are added to the crst_list to be freed later, so they are not lost
forever. However, when unshadowing the region 2 table, we wouldn't trigger
unshadowing of the original shadowed region 3 table that we replaced. It
would get unshadowed when the original region 3 table is modified. As it's
not connected to the page table hierarchy anymore, it's not going to get
used anymore. However, for a limited time, this page table will stick
around, so it's in some sense a temporary memory leak.
Identified by manual code inspection. I don't think this classifies as
stable material.
Fixes: 998f637cc4b9 ("s390/mm: avoid races on region/segment/page table shadowing")
Signed-off-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20200403153050.20569-4-david@redhat.com
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/mm/gmap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index b6c85b760305d..099db32ed104a 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -1680,6 +1680,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t,
goto out_free;
} else if (*table & _REGION_ENTRY_ORIGIN) {
rc = -EAGAIN; /* Race with shadow */
+ goto out_free;
}
crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY);
/* mark as invalid as long as the parent table is not protected */
--
2.20.1
next prev parent reply other threads:[~2020-04-15 12:01 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-15 11:47 [PATCH AUTOSEL 4.9 01/21] clk: at91: usb: continue if clk_hw_round_rate() return zero Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 02/21] power: supply: bq27xxx_battery: Silence deferred-probe error Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 03/21] clk: tegra: Fix Tegra PMC clock out parents Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 04/21] NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 05/21] s390/cpuinfo: fix wrong output when CPU0 is offline Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 06/21] powerpc/maple: Fix declaration made after definition Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 07/21] ext4: do not commit super on read-only bdev Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 08/21] ext4: fix incorrect group count in ext4_fill_super error message Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 09/21] ext4: fix incorrect inodes per group in " Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 10/21] slcan: Don't transmit uninitialized stack data in padding Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 11/21] net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 12/21] percpu_counter: fix a data race at vm_committed_as Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 13/21] compiler.h: fix error in BUILD_BUG_ON() reporting Sasha Levin
2020-04-15 11:47 ` Sasha Levin [this message]
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 15/21] net: dsa: bcm_sf2: Ensure correct sub-node is parsed Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 16/21] NFS: Fix memory leaks in nfs_pageio_stop_mirroring() Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 17/21] mfd: dln2: Fix sanity checking for endpoints Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 18/21] ext2: fix empty body warnings when -Wextra is used Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 19/21] ext2: fix debug reference to ext2_xattr_cache Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 20/21] libnvdimm: Out of bounds read in __nd_ioctl() Sasha Levin
2020-04-15 11:47 ` [PATCH AUTOSEL 4.9 21/21] iommu/amd: Fix the configuration of GCR3 table root pointer Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200415114748.15713-14-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=borntraeger@de.ibm.com \
--cc=david@redhat.com \
--cc=imbrenda@linux.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).