Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 234ff0b7 authored by Paul Mackerras's avatar Paul Mackerras
Browse files

KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU mode switch 



Testing has revealed an occasional crash which appears to be caused
by a race between kvmppc_switch_mmu_to_hpt and kvm_unmap_hva_range_hv.
The symptom is a NULL pointer dereference in __find_linux_pte() called
from kvm_unmap_radix() with kvm->arch.pgtable == NULL.

Looking at kvmppc_switch_mmu_to_hpt(), it does indeed clear
kvm->arch.pgtable (via kvmppc_free_radix()) before setting
kvm->arch.radix to NULL, and there is nothing to prevent
kvm_unmap_hva_range_hv() or the other MMU callback functions from
being called concurrently with kvmppc_switch_mmu_to_hpt() or
kvmppc_switch_mmu_to_radix().

This patch therefore adds calls to spin_lock/unlock on the kvm->mmu_lock
around the assignments to kvm->arch.radix, and makes sure that the
partition-scoped radix tree or HPT is only freed after changing
kvm->arch.radix.

This also takes the kvm->mmu_lock in kvmppc_rmap_reset() to make sure
that the clearing of each rmap array (one per memslot) doesn't happen
concurrently with use of the array in the kvm_unmap_hva_range_hv()
or the other MMU callbacks.

Fixes: 18c3640c ("KVM: PPC: Book3S HV: Add infrastructure for running HPT guests on radix host")
Cc: stable@vger.kernel.org # v4.15+
Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
parent fd65d314

arch/powerpc/kvm/book3s_64_mmu_hv.c

+3 −0
Original line number Diff line number Diff line
@@ -743,12 +743,15 @@ void kvmppc_rmap_reset(struct kvm *kvm) 
	srcu_idx = srcu_read_lock(&kvm->srcu);

	slots = kvm_memslots(kvm);

	kvm_for_each_memslot(memslot, slots) {

		/* Mutual exclusion with kvm_unmap_hva_range etc. */

		spin_lock(&kvm->mmu_lock);

		/*

		 * This assumes it is acceptable to lose reference and

		 * change bits across a reset.

		 */

		memset(memslot->arch.rmap, 0,

		       memslot->npages * sizeof(*memslot->arch.rmap));

		spin_unlock(&kvm->mmu_lock);

	}

	srcu_read_unlock(&kvm->srcu, srcu_idx);

}

arch/powerpc/kvm/book3s_hv.c

+11 −6
Original line number Diff line number Diff line
@@ -4532,12 +4532,15 @@ int kvmppc_switch_mmu_to_hpt(struct kvm *kvm) 
{

	if (nesting_enabled(kvm))

		kvmhv_release_all_nested(kvm);

	kvmppc_rmap_reset(kvm);

	kvm->arch.process_table = 0;

	/* Mutual exclusion with kvm_unmap_hva_range etc. */

	spin_lock(&kvm->mmu_lock);

	kvm->arch.radix = 0;

	spin_unlock(&kvm->mmu_lock);

	kvmppc_free_radix(kvm);

	kvmppc_update_lpcr(kvm, LPCR_VPM1,

			   LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);

	kvmppc_rmap_reset(kvm);

	kvm->arch.radix = 0;

	kvm->arch.process_table = 0;

	return 0;

}
@@ -4549,12 +4552,14 @@ int kvmppc_switch_mmu_to_radix(struct kvm *kvm) 
	err = kvmppc_init_vm_radix(kvm);

	if (err)

		return err;



	kvmppc_rmap_reset(kvm);

	/* Mutual exclusion with kvm_unmap_hva_range etc. */

	spin_lock(&kvm->mmu_lock);

	kvm->arch.radix = 1;

	spin_unlock(&kvm->mmu_lock);

	kvmppc_free_hpt(&kvm->arch.hpt);

	kvmppc_update_lpcr(kvm, LPCR_UPRT | LPCR_GTSE | LPCR_HR,

			   LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);

	kvmppc_rmap_reset(kvm);

	kvm->arch.radix = 1;

	return 0;

}