• Suzuki K Poulose's avatar
    kvm: arm/arm64: Fix use after free of stage2 page table · 0c428a6a
    Suzuki K Poulose authored
    We yield the kvm->mmu_lock occassionaly while performing an operation
    (e.g, unmap or permission changes) on a large area of stage2 mappings.
    However this could possibly cause another thread to clear and free up
    the stage2 page tables while we were waiting for regaining the lock and
    thus the original thread could end up in accessing memory that was
    freed. This patch fixes the problem by making sure that the stage2
    pagetable is still valid after we regain the lock. The fact that
    mmu_notifer->release() could be called twice (via __mmu_notifier_release
    and mmu_notifier_unregsister) enhances the possibility of hitting
    this race where there are two threads trying to unmap the entire guest
    shadow pages.
    
    While at it, cleanup the redudant checks around cond_resched_lock in
    stage2_wp_range(), as cond_resched_lock already does the same checks.
    
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Cc: andreyknvl@google.com
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: stable@vger.kernel.org
    Acked-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
    Reviewed-by: default avatarChristoffer Dall <cdall@linaro.org>
    Signed-off-by: default avatarChristoffer Dall <cdall@linaro.org>
    0c428a6a
mmu.c 51.8 KB