summaryrefslogtreecommitdiffstats
path: root/virt/Makefile
diff options
context:
space:
mode:
authorSuzuki K Poulose <suzuki.poulose@arm.com>2017-05-16 10:34:55 +0100
committerChristoffer Dall <cdall@linaro.org>2017-05-16 11:54:25 +0200
commit0c428a6a9256fcd66817e12db32a50b405ed2e5c (patch)
treeec43e322b3094edbc6808ef31cd404d9b127db51 /virt/Makefile
parent2952a6070e07ebdd5896f1f5b861acad677caded (diff)
downloadlinux-0c428a6a9256fcd66817e12db32a50b405ed2e5c.tar.gz
linux-0c428a6a9256fcd66817e12db32a50b405ed2e5c.tar.bz2
linux-0c428a6a9256fcd66817e12db32a50b405ed2e5c.zip
kvm: arm/arm64: Fix use after free of stage2 page table
We yield the kvm->mmu_lock occassionaly while performing an operation (e.g, unmap or permission changes) on a large area of stage2 mappings. However this could possibly cause another thread to clear and free up the stage2 page tables while we were waiting for regaining the lock and thus the original thread could end up in accessing memory that was freed. This patch fixes the problem by making sure that the stage2 pagetable is still valid after we regain the lock. The fact that mmu_notifer->release() could be called twice (via __mmu_notifier_release and mmu_notifier_unregsister) enhances the possibility of hitting this race where there are two threads trying to unmap the entire guest shadow pages. While at it, cleanup the redudant checks around cond_resched_lock in stage2_wp_range(), as cond_resched_lock already does the same checks. Cc: Mark Rutland <mark.rutland@arm.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: andreyknvl@google.com Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: stable@vger.kernel.org Acked-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reviewed-by: Christoffer Dall <cdall@linaro.org> Signed-off-by: Christoffer Dall <cdall@linaro.org>
Diffstat (limited to 'virt/Makefile')
0 files changed, 0 insertions, 0 deletions