linux-kernel - [PATCH v2 0/3] KVM: MMU: Fix a refcount bug with ZONE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Nov 2019 14:12:26 -0800
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>
Cc:     Sean Christopherson <sean.j.christopherson@...el.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Adam Borowski <kilobyte@...band.pl>,
        David Hildenbrand <david@...hat.com>,
        Dan Williams <dan.j.williams@...el.com>
Subject: [PATCH v2 0/3] KVM: MMU: Fix a refcount bug with ZONE_DEVICE pages

This mini-series fixes a suspected, but technically unconfirmed, bug in
KVM related to ZONE_DEVICE pages.  The suspected issue is that KVM treats
ZONE_DEVICE pages as reserved PFNs, and so doesn't put references to such
pages when dropping references via KVM's generic kvm_release_pfn_clean().

David Hildenbrand uncovered the bug during a discussion about removing
PG_reserved from ZONE_DEVICE pages, after Dan Williams pointed out[1] that
there was a bug report from Adam Borowski[2] that was likely related to
KVM's interaction with PageReserved().

Patch 1/3 contains the actual fix, patches 2/3 and 3/3 are minor cleanup
that is mostly unrelated, but dependent and prompted by the fix itself.

v2:
  - Remove the kvm_is_zone_device_pfn(pfn) check from kvm_get_pfn().  It's
    not entirely clear whether or not the hva_to_pfn_remapped() case is
    actually broken, e.g. KVM's page fault handler is likely ok, whereas
    not calling get_page() willl definitely cause breakage as KVM would
    later call put_page() on the pfn/page. [Paolo]

  - WARN if kvm_is_zone_device_pfn() is called without the underlying
    page being pinned.  This won't necessarily catch all bugs, e.g. if
    the above hva_to_pfn_remapped case is indeed broken, but will
    prevent completely bogus usage. [Dan]

  - Remove the is_error_pfn() check from transparent_hugepage_adjust()
    instead of carrying it forward into the new kvm_is_hugepage_allowed()
    helper. [Paolo]

[1] http://lkml.kernel.org/r/20190919115547.GA17963@angband.pl
[2] https://lkml.kernel.org/r/01adb4cb-6092-638c-0bab-e61322be7cf5@redhat.com

Sean Christopherson (3):
  KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved
  KVM: x86/mmu: Remove superfluous is_error_pfn() check from THP adjust
  KVM: x86/mmu: Add helper to consolidate huge page promotion

 arch/x86/kvm/mmu.c       | 15 +++++++++------
 include/linux/kvm_host.h |  1 +
 virt/kvm/kvm_main.c      | 26 +++++++++++++++++++++++---
 3 files changed, 33 insertions(+), 9 deletions(-)

-- 
2.24.0