From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756357AbdELJMe (ORCPT ); Fri, 12 May 2017 05:12:34 -0400 Received: from foss.arm.com ([217.140.101.70]:57332 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755662AbdELJMK (ORCPT ); Fri, 12 May 2017 05:12:10 -0400 Subject: Re: [PATCH 1/2] kvm: arm/arm64: Fix race in resetting stage2 PGD To: Suzuki K Poulose , christoffer.dall@linaro.org References: <1493821072-29713-1-git-send-email-suzuki.poulose@arm.com> <1493821072-29713-2-git-send-email-suzuki.poulose@arm.com> Cc: agraf@suse.de, andreyknvl@google.com, mark.rutland@arm.com, pbonzini@redhat.com, rkrcmar@redhat.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org From: Marc Zyngier Organization: ARM Ltd Message-ID: <91960d06-c0ff-38c3-4cab-6944cdb65766@arm.com> Date: Fri, 12 May 2017 10:12:06 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <1493821072-29713-2-git-send-email-suzuki.poulose@arm.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/05/17 15:17, Suzuki K Poulose wrote: > In kvm_free_stage2_pgd() we check the stage2 PGD before holding > the lock and proceed to take the lock if it is valid. And we unmap > the page tables, followed by releasing the lock. We reset the PGD > only after dropping this lock, which could cause a race condition > where another thread waiting on or even holding the lock, could > potentially see that the PGD is still valid and proceed to perform > a stage2 operation and later encounter a NULL PGD. > > [223090.242280] Unable to handle kernel NULL pointer dereference at > virtual address 00000040 > [223090.262330] PC is at unmap_stage2_range+0x8c/0x428 > [223090.262332] LR is at kvm_unmap_hva_handler+0x2c/0x3c > [223090.262531] Call trace: > [223090.262533] [] unmap_stage2_range+0x8c/0x428 > [223090.262535] [] kvm_unmap_hva_handler+0x2c/0x3c > [223090.262537] [] handle_hva_to_gpa+0xb0/0x104 > [223090.262539] [] kvm_unmap_hva+0x5c/0xbc > [223090.262543] [] > kvm_mmu_notifier_invalidate_page+0x50/0x8c > [223090.262547] [] > __mmu_notifier_invalidate_page+0x5c/0x84 > [223090.262551] [] try_to_unmap_one+0x1d0/0x4a0 > [223090.262553] [] rmap_walk+0x1cc/0x2e0 > [223090.262555] [] try_to_unmap+0x74/0xa4 > [223090.262557] [] migrate_pages+0x31c/0x5ac > [223090.262561] [] compact_zone+0x3fc/0x7ac > [223090.262563] [] compact_zone_order+0x94/0xb0 > [223090.262564] [] try_to_compact_pages+0x108/0x290 > [223090.262569] [] __alloc_pages_direct_compact+0x70/0x1ac > [223090.262571] [] __alloc_pages_nodemask+0x434/0x9f4 > [223090.262572] [] alloc_pages_vma+0x230/0x254 > [223090.262574] [] do_huge_pmd_anonymous_page+0x114/0x538 > [223090.262576] [] handle_mm_fault+0xd40/0x17a4 > [223090.262577] [] __get_user_pages+0x12c/0x36c > [223090.262578] [] get_user_pages_unlocked+0xa4/0x1b8 > [223090.262579] [] __gfn_to_pfn_memslot+0x280/0x31c > [223090.262580] [] gfn_to_pfn_prot+0x4c/0x5c > [223090.262582] [] kvm_handle_guest_abort+0x240/0x774 > [223090.262584] [] handle_exit+0x11c/0x1ac > [223090.262586] [] kvm_arch_vcpu_ioctl_run+0x31c/0x648 > [223090.262587] [] kvm_vcpu_ioctl+0x378/0x768 > [223090.262590] [] do_vfs_ioctl+0x324/0x5a4 > [223090.262591] [] SyS_ioctl+0x90/0xa4 > [223090.262595] [] el0_svc_naked+0x38/0x3c > > This patch moves the stage2 PGD manipulation under the lock. > > Reported-by: Alexander Graf > Cc: Mark Rutland > Cc: Marc Zyngier > Cc: Paolo Bonzini > Cc: Radim Krčmář > Reviewed-by: Christoffer Dall > Signed-off-by: Suzuki K Poulose Reviewed-by: Marc Zyngier M. -- Jazz is not dead. It just smells funny...