]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
kvm: mmu: Fix race in emulated page table writes
authorJunaid Shahid <junaids@google.com>
Wed, 31 Oct 2018 21:53:57 +0000 (14:53 -0700)
committerPaolo Bonzini <pbonzini@redhat.com>
Tue, 27 Nov 2018 11:50:31 +0000 (12:50 +0100)
commit0e0fee5c539b61fdd098332e0e2cc375d9073706
treea5788edffb775ef66019c86b430c8f6a6015e66b
parent52ad7eb3d668867f9ee2e34d715cfb4860d36a93
kvm: mmu: Fix race in emulated page table writes

When a guest page table is updated via an emulated write,
kvm_mmu_pte_write() is called to update the shadow PTE using the just
written guest PTE value. But if two emulated guest PTE writes happened
concurrently, it is possible that the guest PTE and the shadow PTE end
up being out of sync. Emulated writes do not mark the shadow page as
unsync-ed, so this inconsistency will not be resolved even by a guest TLB
flush (unless the page was marked as unsync-ed at some other point).

This is fixed by re-reading the current value of the guest PTE after the
MMU lock has been acquired instead of just using the value that was
written prior to calling kvm_mmu_pte_write().

Signed-off-by: Junaid Shahid <junaids@google.com>
Reviewed-by: Wanpeng Li <wanpengli@tencent.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/mmu.c