• Christoffer Dall's avatar
    KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less · cb754d67
    Christoffer Dall authored
    commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 upstream.
    
    We recently addressed a VMID generation race by introducing a read/write
    lock around accesses and updates to the vmid generation values.
    
    However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
    does so without taking the read lock.
    
    As far as I can tell, this can lead to the same kind of race:
    
      VM 0, VCPU 0			VM 0, VCPU 1
      ------------			------------
      update_vttbr (vmid 254)
      				update_vttbr (vmid 1) // roll over
    				read_lock(kvm_vmid_lock);
    				force_vm_exit()
      local_irq_disable
      need_new_vmid_gen == false //because vmid gen matches
    
      enter_guest (vmid 254)
      				kvm_arch.vttbr = <PGD>:<VMID 1>
    				read_unlock(kvm_vmid_lock);
    
      				enter_guest (vmid 1)
    
    Which results in running two VCPUs in the same VM with different VMIDs
    and (even worse) other VCPUs from other VMs could now allocate clashing
    VMID 254 from the new generation as long as VCPU 0 is not exiting.
    
    Attempt to solve this by making sure vttbr is updated before another CPU
    can observe the updated VMID generation.
    
    Cc: stable@vger.kernel.org
    Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
    Reviewed-by: 's avatarJulien Thierry <julien.thierry@arm.com>
    Signed-off-by: 's avatarChristoffer Dall <christoffer.dall@arm.com>
    Signed-off-by: 's avatarMarc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    cb754d67
Name
Last commit
Last update
..
kvm Loading commit data...
lib Loading commit data...
Makefile Loading commit data...