diff options
| author | Fuad Tabba <tabba@google.com> | 2023-05-22 13:32:58 +0300 |
|---|---|---|
| committer | Marc Zyngier <maz@kernel.org> | 2023-05-24 15:47:12 +0300 |
| commit | a9f0e3d5a089d0844abb679a5e99f15010d53e25 (patch) | |
| tree | 37d02362d2d860d49dc7bfdcf7438ddfac38ad12 /arch/arm64/include/asm/kvm_pgtable.h | |
| parent | d282fa3c5ccb7a0029c418f358143689553b6447 (diff) | |
| download | linux-a9f0e3d5a089d0844abb679a5e99f15010d53e25.tar.xz | |
KVM: arm64: Reload PTE after invoking walker callback on preorder traversal
The preorder callback on the kvm_pgtable_stage2_map() path can replace
a table with a block, then recursively free the detached table. The
higher-level walking logic stashes the old page table entry and
then walks the freed table, invoking the leaf callback and
potentially freeing pgtable pages prematurely.
In normal operation, the call to tear down the detached stage-2
is indirected and uses an RCU callback to trigger the freeing.
RCU is not available to pKVM, which is where this bug is
triggered.
Change the behavior of the walker to reload the page table entry
after invoking the walker callback on preorder traversal, as it
does for leaf entries.
Tested on Pixel 6.
Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make")
Suggested-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230522103258.402272-1-tabba@google.com
Diffstat (limited to 'arch/arm64/include/asm/kvm_pgtable.h')
| -rw-r--r-- | arch/arm64/include/asm/kvm_pgtable.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h index dc3c072e862f..93bd0975b15f 100644 --- a/arch/arm64/include/asm/kvm_pgtable.h +++ b/arch/arm64/include/asm/kvm_pgtable.h @@ -632,9 +632,9 @@ int kvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size); * * The walker will walk the page-table entries corresponding to the input * address range specified, visiting entries according to the walker flags. - * Invalid entries are treated as leaf entries. Leaf entries are reloaded - * after invoking the walker callback, allowing the walker to descend into - * a newly installed table. + * Invalid entries are treated as leaf entries. The visited page table entry is + * reloaded after invoking the walker callback, allowing the walker to descend + * into a newly installed table. * * Returning a negative error code from the walker callback function will * terminate the walk immediately with the same error code. |