diff options
| author | Chengfeng Ye <nicoyip.dev@gmail.com> | 2026-08-26 02:39:24 +0800 |
|---|---|---|
| committer | Sean Christopherson <seanjc@google.com> | 2026-09-11 11:48:04 -0700 |
| commit | b59a87c1ba3c347e8aec5f932eb7abf13064fd62 (patch) | |
| tree | e67c359050674e28dc3abef6bb7d2f49de6fe652 | |
| parent | d4b7fb647204f0c81dfeae2d1a708e4d858e0c94 (diff) | |
| download | linux-next-b59a87c1ba3c347e8aec5f932eb7abf13064fd62.tar.gz linux-next-b59a87c1ba3c347e8aec5f932eb7abf13064fd62.zip | |
KVM: x86: Take SRCU in kvm_zap_gfn_range()
kvm_zap_gfn_range() walks memslots and rmaps and may drop mmu_lock to
reschedule. Callers that do not already hold kvm->srcu (or slots_lock)
can race with memslot deletion: synchronize_srcu_expedited() does not
wait, kvm_free_memslot() frees the old slot and its rmap, and the zap
resumes on freed memory.
The VFIO noncoherent-DMA path hits this by zapping the entire GPA
space without SRCU. KASAN reported:
BUG: KASAN: vmalloc-out-of-bounds in slot_rmap_walk_next+0x82/0x1c0
Read of size 8 at addr ffffc900005c1008
Call Trace:
slot_rmap_walk_next+0x82/0x1c0
__kvm_rmap_zap_gfn_range+0x17a/0x280
kvm_zap_gfn_range+0x2a6/0x6a0
kvm_vfio_set_attr+0x576/0x770
kvm_device_ioctl+0x1ff/0x3b0
Take SRCU inside kvm_zap_gfn_range() so every caller is covered.
Nesting with an existing kvm->srcu critical section is fine; the
helper uses a local index. Drop the now-redundant SRCU pair from
__kvm_set_or_clear_apicv_inhibit().
Fixes: 362ff6dca541 ("KVM: x86/mmu: Zap KVM TDP when noncoherent DMA assignment starts/stops")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260825183924.237727-1-nicoyip.dev@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
| -rw-r--r-- | arch/x86/kvm/mmu/mmu.c | 2 | ||||
| -rw-r--r-- | arch/x86/kvm/x86.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 064ecc33b926..87518f238e5e 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -7117,6 +7117,8 @@ void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end) if (WARN_ON_ONCE(gfn_end <= gfn_start)) return; + guard(srcu)(&kvm->srcu); + write_lock(&kvm->mmu_lock); kvm_mmu_invalidate_start(kvm); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 79468ddfe473..15721ce659bb 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7925,10 +7925,8 @@ void __kvm_set_or_clear_apicv_inhibit(struct kvm *kvm, kvm->arch.apicv_inhibit_reasons = new; if (new) { unsigned long gfn = gpa_to_gfn(APIC_DEFAULT_PHYS_BASE); - int idx = srcu_read_lock(&kvm->srcu); kvm_zap_gfn_range(kvm, gfn, gfn+1); - srcu_read_unlock(&kvm->srcu, idx); } } else { kvm->arch.apicv_inhibit_reasons = new; |