diff options
author | Ben Gardon <bgardon@google.com> | 2021-01-06 16:19:34 -0800 |
---|---|---|
committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-01-07 18:11:31 -0500 |
commit | a889ea54b3daa63ee1463dc19ed699407d61458b (patch) | |
tree | 5f2b41f8c8b04523e628a4599aaa46df9c2e468d /arch/x86/include | |
parent | 88bf56d04bc3564542049ec4ec168a8b60d0b48c (diff) | |
download | linux-a889ea54b3daa63ee1463dc19ed699407d61458b.tar.gz linux-a889ea54b3daa63ee1463dc19ed699407d61458b.tar.bz2 linux-a889ea54b3daa63ee1463dc19ed699407d61458b.zip |
KVM: x86/mmu: Ensure TDP MMU roots are freed after yield
Many TDP MMU functions which need to perform some action on all TDP MMU
roots hold a reference on that root so that they can safely drop the MMU
lock in order to yield to other threads. However, when releasing the
reference on the root, there is a bug: the root will not be freed even
if its reference count (root_count) is reduced to 0.
To simplify acquiring and releasing references on TDP MMU root pages, and
to ensure that these roots are properly freed, move the get/put operations
into another TDP MMU root iterator macro.
Moving the get/put operations into an iterator macro also helps
simplify control flow when a root does need to be freed. Note that using
the list_for_each_entry_safe macro would not have been appropriate in
this situation because it could keep a pointer to the next root across
an MMU lock release + reacquire, during which time that root could be
freed.
Reported-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Fixes: faaf05b00aec ("kvm: x86/mmu: Support zapping SPTEs in the TDP MMU")
Fixes: 063afacd8730 ("kvm: x86/mmu: Support invalidate range MMU notifier for TDP MMU")
Fixes: a6a0b05da9f3 ("kvm: x86/mmu: Support dirty logging for the TDP MMU")
Fixes: 14881998566d ("kvm: x86/mmu: Support disabling dirty logging for the tdp MMU")
Signed-off-by: Ben Gardon <bgardon@google.com>
Message-Id: <20210107001935.3732070-1-bgardon@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch/x86/include')
0 files changed, 0 insertions, 0 deletions