Skip to contentSkip to conversation

KVM: s390: vsie: fix race during shadow creation

PATCH In review Christian Borntraeger 4 participants 5 messages Dec 20, 2023 – Dec 21, 2023

Subsystems (4)
KVM s390 s390 MM KVM s390
lore
Share & tools
lore

Christian Borntraeger

author maintainer
#0 lore raw

PATCH v2 1/1 KVM: s390: vsie: fix race during shadow creation

Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]

        gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
        if (IS_ERR(gmap))
                return PTR_ERR(gmap);
        gmap->private = vcpu->kvm;

Let children inherit the private field of the parent.

Reported-by Marc Hartmayer <[email protected]>
Fixes a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc <[email protected]>
Cc David Hildenbrand <[email protected]>
Signed-off-by Christian Borntraeger <[email protected]>

---
v1->v2: let the child inherit private from parent instead of accessing
the parent in the notifier

 arch/s390/kvm/vsie.c | 1 -
 arch/s390/mm/gmap.c  | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)
arch/s390/kvm/vsie.c +0 -1
index 8207a892bbe2..db9a180de65f 100644
@@ -1220,7 +1220,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
 	gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
 	if (IS_ERR(gmap))
 		return PTR_ERR(gmap);
-	gmap->private = vcpu->kvm;
 	vcpu->kvm->stat.gmap_shadow_create++;
 	WRITE_ONCE(vsie_page->gmap, gmap);
 	return 0;
arch/s390/mm/gmap.c +1 -0
index 6f96b5a71c63..8da39deb56ca 100644
@@ -1691,6 +1691,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce,
 		return ERR_PTR(-ENOMEM);
 	new->mm = parent->mm;
 	new->parent = gmap_get(parent);
+	new->private = parent->private;
 	new->orig_asce = asce;
 	new->edat_level = edat_level;
 	new->initialized = false;
Signature · 1 line
2.41.0
maintainer Reviewed-by on v2 1/1
#1 lore raw
Quoted 3 lines · Christian Borntraeger

Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:

Reviewed-by Janosch Frank <[email protected]>
Reviewed-by on v2 1/1
#2 lore raw
In reply to Christian Borntraeger
Quoted 13 lines · Christian Borntraeger

Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]

         gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
         if (IS_ERR(gmap))
                 return PTR_ERR(gmap);
         gmap->private = vcpu->kvm;
Quoted 8 lines

Let children inherit the private field of the parent.

Reported-by Marc Hartmayer <[email protected]>
Fixes a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc <[email protected]>
Cc David Hildenbrand <[email protected]>
Signed-off-by Christian Borntraeger <[email protected]>

---

Reviewed-by David Hildenbrand <[email protected]>
Signature · 3 lines
Cheers,

David / dhildenb
maintainer Reviewed-by on v2 1/1
#3 lore raw
In reply to Christian Borntraeger
Quoted 13 lines · On Wed, 20 Dec 2023 13:53:17 +0100 Christian Borntraeger…

Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]

        gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
        if (IS_ERR(gmap))
                return PTR_ERR(gmap);
        gmap->private = vcpu->kvm;
Quoted 7 lines

Let children inherit the private field of the parent.

Reported-by Marc Hartmayer <[email protected]>
Fixes a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc <[email protected]>
Cc David Hildenbrand <[email protected]>
Signed-off-by Christian Borntraeger <[email protected]>
Reviewed-by Claudio Imbrenda <[email protected]>
Quoted 31 lines

---
v1->v2: let the child inherit private from parent instead of accessing
the parent in the notifier

 arch/s390/kvm/vsie.c | 1 -
 arch/s390/mm/gmap.c  | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)
arch/s390/kvm/vsie.c +0 -1
index 8207a892bbe2..db9a180de65f 100644
@@ -1220,7 +1220,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
 	gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
 	if (IS_ERR(gmap))
 		return PTR_ERR(gmap);
-	gmap->private = vcpu->kvm;
 	vcpu->kvm->stat.gmap_shadow_create++;
 	WRITE_ONCE(vsie_page->gmap, gmap);
 	return 0;
arch/s390/mm/gmap.c +1 -0
index 6f96b5a71c63..8da39deb56ca 100644
@@ -1691,6 +1691,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce,
 		return ERR_PTR(-ENOMEM);
 	new->mm = parent->mm;
 	new->parent = gmap_get(parent);
+	new->private = parent->private;
 	new->orig_asce = asce;
 	new->edat_level = edat_level;
 	new->initialized = false;
author maintainer
#4 lore raw
In reply to Christian Borntraeger

Am 20.12.23 um 13:53 schrieb Christian Borntraeger:

Quoted 13 lines

Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]

         gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
         if (IS_ERR(gmap))
                 return PTR_ERR(gmap);
         gmap->private = vcpu->kvm;
Quoted 7 lines

Let children inherit the private field of the parent.

Reported-by Marc Hartmayer <[email protected]>
Fixes a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc <[email protected]>
Cc David Hildenbrand <[email protected]>
Signed-off-by Christian Borntraeger <[email protected]>

queue on kvms390/master.