linux-kernel - RE: [PATCH] Drivers: hv: Do not free synic pages when they were not allocated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BYAPR21MB1688A4EA2E802B66AADC3324D7969@BYAPR21MB1688.namprd21.prod.outlook.com>
Date:   Fri, 7 Apr 2023 15:22:16 +0000
From:   "Michael Kelley (LINUX)" <mikelley@...rosoft.com>
To:     Nuno Das Neves <nunodasneves@...ux.microsoft.com>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     KY Srinivasan <kys@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Dexuan Cui <decui@...rosoft.com>
Subject: RE: [PATCH] Drivers: hv: Do not free synic pages when they were not
 allocated

From: Nuno Das Neves <nunodasneves@...ux.microsoft.com> Sent: Monday, April 3, 2023 4:22 PM
> 
> In case of root partition or snp, the synic pages are allocated by the
> hypervisor instead of the kernel, so they should not be freed.

This patch doesn't hurt anything, but is it really needed?   In the SNP
Isolation or root partition case, after hv_synic_alloc() has run, the
synic_event_page and synic_message_page pointers are NULL.  Then
when hv_synic_enable_regs() is run by a particular CPU, that CPU
maps the pages and the pointers are non-NULL.  But the corresponding
hv_synic_disable_regs() sets the pointers back to NULL, so
hv_synic_free() will already skip those pages.

Is there ever a case where hv_synic_free() would run after a CPU
has done hv_synic_enable_regs(), but not hv_synic_disable_regs()?
If that were the case, it seems like we would have other problems,
such as missing calls to iounmap().

Michael

> 
> Signed-off-by: Nuno Das Neves <nunodasneves@...ux.microsoft.com>
> ---
>  drivers/hv/hv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
> index c7f7652932ca..a10cf642c9ad 100644
> --- a/drivers/hv/hv.c
> +++ b/drivers/hv/hv.c
> @@ -193,8 +193,10 @@ void hv_synic_free(void)
>  		struct hv_per_cpu_context *hv_cpu
>  			= per_cpu_ptr(hv_context.cpu_context, cpu);
> 
> -		free_page((unsigned long)hv_cpu->synic_event_page);
> -		free_page((unsigned long)hv_cpu->synic_message_page);
> +		if (!hv_isolation_type_snp() && !hv_root_partition) {
> +			free_page((unsigned long)hv_cpu->synic_event_page);
> +			free_page((unsigned long)hv_cpu->synic_message_page);
> +		}
>  		free_page((unsigned long)hv_cpu->post_msg_page);
>  	}
> 
> --
> 2.25.1