From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758239AbdJMNjg (ORCPT ); Fri, 13 Oct 2017 09:39:36 -0400 Received: from out1.zte.com.cn ([202.103.147.172]:47536 "EHLO mxct.zte.com.cn" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758059AbdJMNje (ORCPT ); Fri, 13 Oct 2017 09:39:34 -0400 From: Peng Hao To: pbonzini@redhat.com, rkrcmar@redhat.com Cc: x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Peng Hao Subject: [PATCH] KVM: X86: fix a bad_page bug_on path Date: Sat, 14 Oct 2017 05:48:14 +0800 Message-Id: <1507931294-58108-1-git-send-email-peng.hao2@zte.com.cn> X-Mailer: git-send-email 1.8.3.1 X-MIMETrack: Itemize by SMTP Server on SZSMTP06/server/zte_ltd(Release 8.5.3FP6|November 21, 2013) at 2017-10-13 21:39:31, Serialize by Router on notes_smtp/zte_ltd(Release 9.0.1FP7|August 17, 2016) at 2017-10-13 21:39:09, Serialize complete at 2017-10-13 21:39:09 X-MAIL: mse01.zte.com.cn v9DDdOJa053669 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When poweroff L1 Guest with L2 guset on L1, it exists a path to trigger a bad_page bug_on. !page_count(pfn_to_page(pfn)) Warning in mmu_spte_clear_track_bits will appear before,then it may set A/D bit for the freed page and trigger a bad_page bug_on. Signed-off-by: Peng Hao --- arch/x86/kvm/mmu.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index eca30c1..398de96 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -711,12 +711,8 @@ static int mmu_spte_clear_track_bits(u64 *sptep) pfn = spte_to_pfn(old_spte); - /* - * KVM does not hold the refcount of the page used by - * kvm mmu, before reclaiming the page, we should - * unmap it from mmu first. - */ - WARN_ON(!kvm_is_reserved_pfn(pfn) && !page_count(pfn_to_page(pfn))); + if (!page_count(pfn_to_page(pfn))) + return 1; if (is_accessed_spte(old_spte)) kvm_set_pfn_accessed(pfn); -- 1.8.3.1