From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758239AbdJMPEZ (ORCPT ); Fri, 13 Oct 2017 11:04:25 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43777 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753478AbdJMPEY (ORCPT ); Fri, 13 Oct 2017 11:04:24 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com CCBB0C059B7B Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH] KVM: X86: fix a bad_page bug_on path To: Peng Hao , rkrcmar@redhat.com Cc: x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Junaid Shahid , Xiao Guangrong References: <1507931294-58108-1-git-send-email-peng.hao2@zte.com.cn> From: Paolo Bonzini Message-ID: Date: Fri, 13 Oct 2017 17:04:13 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <1507931294-58108-1-git-send-email-peng.hao2@zte.com.cn> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Fri, 13 Oct 2017 15:04:23 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 13/10/2017 23:48, Peng Hao wrote: > When poweroff L1 Guest with L2 guset on L1, it exists a path to > trigger a bad_page bug_on. How easy it is to reproduce? CCing Junaid and Guangrong too. > !page_count(pfn_to_page(pfn)) Warning in mmu_spte_clear_track_bits will > appear before,then it may set A/D bit for the freed page and trigger a > bad_page bug_on. > > Signed-off-by: Peng Hao > --- > arch/x86/kvm/mmu.c | 8 ++------ > 1 file changed, 2 insertions(+), 6 deletions(-) > > diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c > index eca30c1..398de96 100644 > --- a/arch/x86/kvm/mmu.c > +++ b/arch/x86/kvm/mmu.c > @@ -711,12 +711,8 @@ static int mmu_spte_clear_track_bits(u64 *sptep) > > pfn = spte_to_pfn(old_spte); > > - /* > - * KVM does not hold the refcount of the page used by > - * kvm mmu, before reclaiming the page, we should > - * unmap it from mmu first. > - */ > - WARN_ON(!kvm_is_reserved_pfn(pfn) && !page_count(pfn_to_page(pfn))); > + if (!page_count(pfn_to_page(pfn))) > + return 1; If the page count is zero, KVM should not have accessed this page at all. The bug is elsewhere. :( Paolo > if (is_accessed_spte(old_spte)) > kvm_set_pfn_accessed(pfn); >