[lkml]   [2010]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH RFC] kvm: write protect memory after slot swap
    I have observed the following bug trigger:

    1. userspace calls GET_DIRTY_LOG
    2. kvm_mmu_slot_remove_write_access is called and makes a page ro
    3. page fault happens and makes the page writeable
    fault is logged in the bitmap appropriately
    4. kvm_vm_ioctl_get_dirty_log swaps slot pointers

    a lot of time passes

    5. guest writes into the page
    6. userspace calls GET_DIRTY_LOG

    At point (5), bitmap is clean and page is writeable,
    thus, guest modification of memory is not logged
    and GET_DIRTY_LOG returns an empty bitmap.

    The rule is that all pages are either dirty in the current bitmap,
    or write-protected, which is violated here.

    It seems that just moving kvm_mmu_slot_remove_write_access down
    to after the slot pointer swap should fix this bug.

    Warning: completely untested.
    Please comment.
    Note: fix will be needed for -stable etc.

    Signed-off-by: Michael S. Tsirkin <>
    arch/x86/kvm/x86.c | 8 ++++----
    1 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 3a09c62..4ca1d7f 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -2912,10 +2912,6 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
    struct kvm_memslots *slots, *old_slots;
    unsigned long *dirty_bitmap;

    - spin_lock(&kvm->mmu_lock);
    - kvm_mmu_slot_remove_write_access(kvm, log->slot);
    - spin_unlock(&kvm->mmu_lock);
    r = -ENOMEM;
    dirty_bitmap = vmalloc(n);
    if (!dirty_bitmap)
    @@ -2937,6 +2933,10 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
    dirty_bitmap = old_slots->memslots[log->slot].dirty_bitmap;

    + spin_lock(&kvm->mmu_lock);
    + kvm_mmu_slot_remove_write_access(kvm, log->slot);
    + spin_unlock(&kvm->mmu_lock);
    r = -EFAULT;
    if (copy_to_user(log->dirty_bitmap, dirty_bitmap, n)) {

     \ /
      Last update: 2010-10-25 03:31    [W:0.020 / U:0.900 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site