Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3984e80 authored by Paul Mackerras's avatar Paul Mackerras Committed by Greg Kroah-Hartman
Browse files

KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch 



[ Upstream commit 234ff0b729ad882d20f7996591a964965647addf ]

Testing has revealed an occasional crash which appears to be caused
by a race between kvmppc_switch_mmu_to_hpt and kvm_unmap_hva_range_hv.
The symptom is a NULL pointer dereference in __find_linux_pte() called
from kvm_unmap_radix() with kvm->arch.pgtable == NULL.

Looking at kvmppc_switch_mmu_to_hpt(), it does indeed clear
kvm->arch.pgtable (via kvmppc_free_radix()) before setting
kvm->arch.radix to NULL, and there is nothing to prevent
kvm_unmap_hva_range_hv() or the other MMU callback functions from
being called concurrently with kvmppc_switch_mmu_to_hpt() or
kvmppc_switch_mmu_to_radix().

This patch therefore adds calls to spin_lock/unlock on the kvm->mmu_lock
around the assignments to kvm->arch.radix, and makes sure that the
partition-scoped radix tree or HPT is only freed after changing
kvm->arch.radix.

This also takes the kvm->mmu_lock in kvmppc_rmap_reset() to make sure
that the clearing of each rmap array (one per memslot) doesn't happen
concurrently with use of the array in the kvm_unmap_hva_range_hv()
or the other MMU callbacks.

Fixes: 18c3640c ("KVM: PPC: Book3S HV: Add infrastructure for running HPT guests on radix host")
Cc: stable@vger.kernel.org # v4.15+
Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d88b01d0

arch/powerpc/kvm/book3s_64_mmu_hv.c

+3 −0
Original line number Diff line number Diff line
@@ -744,12 +744,15 @@ void kvmppc_rmap_reset(struct kvm *kvm) 
	srcu_idx = srcu_read_lock(&kvm->srcu);

	slots = kvm_memslots(kvm);

	kvm_for_each_memslot(memslot, slots) {

		/* Mutual exclusion with kvm_unmap_hva_range etc. */

		spin_lock(&kvm->mmu_lock);

		/*

		 * This assumes it is acceptable to lose reference and

		 * change bits across a reset.

		 */

		memset(memslot->arch.rmap, 0,

		       memslot->npages * sizeof(*memslot->arch.rmap));

		spin_unlock(&kvm->mmu_lock);

	}

	srcu_read_unlock(&kvm->srcu, srcu_idx);

}

arch/powerpc/kvm/book3s_hv.c

+11 −4
Original line number Diff line number Diff line
@@ -3813,12 +3813,15 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu) 
/* Must be called with kvm->lock held and mmu_ready = 0 and no vcpus running */

int kvmppc_switch_mmu_to_hpt(struct kvm *kvm)

{

	kvmppc_rmap_reset(kvm);

	kvm->arch.process_table = 0;

	/* Mutual exclusion with kvm_unmap_hva_range etc. */

	spin_lock(&kvm->mmu_lock);

	kvm->arch.radix = 0;

	spin_unlock(&kvm->mmu_lock);

	kvmppc_free_radix(kvm);

	kvmppc_update_lpcr(kvm, LPCR_VPM1,

			   LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);

	kvmppc_rmap_reset(kvm);

	kvm->arch.radix = 0;

	kvm->arch.process_table = 0;

	return 0;

}
@@ -3831,10 +3834,14 @@ int kvmppc_switch_mmu_to_radix(struct kvm *kvm) 
	if (err)

		return err;



	kvmppc_rmap_reset(kvm);

	/* Mutual exclusion with kvm_unmap_hva_range etc. */

	spin_lock(&kvm->mmu_lock);

	kvm->arch.radix = 1;

	spin_unlock(&kvm->mmu_lock);

	kvmppc_free_hpt(&kvm->arch.hpt);

	kvmppc_update_lpcr(kvm, LPCR_UPRT | LPCR_GTSE | LPCR_HR,

			   LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);

	kvm->arch.radix = 1;

	return 0;

}