From nobody Fri Jun 19 22:36:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 269ABC433F5 for ; Sun, 27 Mar 2022 20:35:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233440AbiC0UhQ (ORCPT ); Sun, 27 Mar 2022 16:37:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231859AbiC0UhO (ORCPT ); Sun, 27 Mar 2022 16:37:14 -0400 Received: from mail-pj1-x104a.google.com (mail-pj1-x104a.google.com [IPv6:2607:f8b0:4864:20::104a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 30BD131935 for ; Sun, 27 Mar 2022 13:35:35 -0700 (PDT) Received: by mail-pj1-x104a.google.com with SMTP id e15-20020a17090ab38f00b001c9989ae56cso1190382pjr.9 for ; Sun, 27 Mar 2022 13:35:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:message-id:mime-version:subject:from:to:cc; bh=9l3gztPA4wtuBVPjKquVrCus2mQqcSAyx1f1VGo4bsk=; b=oyq8RWbljF3omcA3hH4gl/L3//Z1KwCgKNtZKKmr98wWG1RuwkUKS/XdAnKJG8JsW9 bD5KSS9AFJnAtVH6kw/oA48qhbFDm5kTMmjT1uKToo+N1yyudSZFs4BNiDXint0Mx73O ZU7VmCKVYVz6+Z2fTDlPy5qAYBTZBF4cPePEXEYUD89Uzljw4MSmRAjv/FcDg2cpz3i0 xGdlW79SqpPEWU7bXGSBXQL3T/29TdQX52yiKIGvTYEiFTUsfOsaO2Z1e9vp+x0gLgUC B/gC4fXNfb1fhZ7tvojY6SNvK+4BBOsMjE0HZqTJNO6LdOFcHfFB9NGLQWDrrHA/E9nc yKpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:message-id:mime-version:subject :from:to:cc; bh=9l3gztPA4wtuBVPjKquVrCus2mQqcSAyx1f1VGo4bsk=; b=tapNw2k0T5S3aZOjwmPDFOu439UdqGhDtpNpwUSeTP5MhnRUlzaY8T2rZwJQyleU4b Yc8MFPyWT5adZu6+dP2rPwo9GUL/KGmEEx4T0KZAvZjH7CgUmjqmM7D3M9s1JbZ574AS XHIpYh4MFcagUUbbbcdPEIc7PXiZ8GF1IAh4vzzgLCKLafT3fH2tvXYHrmWE8JpEfFGf mZIBHEgSfplphNrgxpD5fLH1YKgvhjnVadd13kma9xRX1F3yp4q3//1elp83K/7jEyRq GACov1UKTIVmULoDUkJzoc+AHc65u8gCzPTvvz7GRrrdFrke3GhJAA+cfp2wlWDDdQzT rpZw== X-Gm-Message-State: AOAM531wgOy/DZnNDM4HvqiqP0GphbzmzyzAThu9rPdS5Ue7HUbz75li j52imNPqFTm8qmwSU0ROXEPZqod81Knp X-Google-Smtp-Source: ABdhPJyqtVod/LCY2erleBb/XsReu0oEcBeFmOcQvYIZY4Wzd1rzn/8G672H1CuGzyv4BJ2I4oS0n/YmwyaG X-Received: from mizhang-super.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:1071]) (user=mizhang job=sendgmr) by 2002:a17:90a:d681:b0:1be:e3e5:3e6e with SMTP id x1-20020a17090ad68100b001bee3e53e6emr36730653pju.122.1648413334619; Sun, 27 Mar 2022 13:35:34 -0700 (PDT) Reply-To: Mingwei Zhang Date: Sun, 27 Mar 2022 20:35:32 +0000 Message-Id: <20220327203532.407821-1-mizhang@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.35.1.1021.g381101b075-goog Subject: [PATCH] KVM: x86/mmu: add lockdep check before lookup_address_in_mm() From: Mingwei Zhang To: Paolo Bonzini Cc: Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Ben Gardon , David Matlack , Mingwei Zhang Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a lockdep check before invoking lookup_address_in_mm(). lookup_address_in_mm() walks all levels of host page table without accquiring any lock. This is usually unsafe unless we are walking the kernel addresses (check other usage cases of lookup_address_in_mm and lookup_address_in_pgd). Walking host page table (especially guest addresses) usually requires holding two types of locks: 1) mmu_lock in mm or the lock that protects the reverse maps of host memory in range; 2) lock for the leaf paging structures. One exception case is when we take the mmu_lock of the secondary mmu. Holding mmu_lock of KVM MMU in either read mode or write mode prevents host level entities from modifying the host page table concurrently. This is because all of them will have to invoke KVM mmu_notifier first before doing the actual work. Since KVM mmu_notifier invalidation operations always take the mmu write lock, we are safe if we hold the mmu lock here. Note: this means that KVM cannot allow concurrent multiple mmu_notifier invalidation callbacks by using KVM mmu read lock. Since, otherwise, any host level entity can cause race conditions with this one. Walking host page table here may get us stale information or may trigger NULL ptr dereference that is hard to reproduce. Having a lockdep check here will prevent or at least warn future development that directly walks host page table simply in a KVM ioctl function. In addition, it provides a record for any future development on KVM mmu_notifier. Cc: Sean Christopherson Cc: Ben Gardon Cc: David Matlack Signed-off-by: Mingwei Zhang --- arch/x86/kvm/mmu/mmu.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 1361eb4599b4..342aa184c0a2 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2820,6 +2820,24 @@ static int host_pfn_mapping_level(struct kvm *kvm, g= fn_t gfn, kvm_pfn_t pfn, */ hva =3D __gfn_to_hva_memslot(slot, gfn); =20 + /* + * lookup_address_in_mm() walks all levels of host page table without + * accquiring any lock. This is not safe when KVM does not take the + * mmu_lock. Holding mmu_lock in either read mode or write mode prevents + * host level entities from modifying the host page table. This is + * because all of them will have to invoke KVM mmu_notifier first before + * doing the actual work. Since KVM mmu_notifier invalidation operations + * always take the mmu write lock, we are safe if we hold the mmu lock + * here. + * + * Note: this means that KVM cannot allow concurrent multiple + * mmu_notifier invalidation callbacks by using KVM mmu read lock. + * Otherwise, any host level entity can cause race conditions with this + * one. Walking host page table here may get us stale information or may + * trigger NULL ptr dereference that is hard to reproduce. + */ + lockdep_is_held(kvm->mmu_lock); + pte =3D lookup_address_in_mm(kvm->mm, hva, &level); if (unlikely(!pte)) return PG_LEVEL_4K; --=20 2.35.1.1021.g381101b075-goog