)]}'
{
  "commit": "ed69a6cb700880d052a0d085ff2e5bfc108ce238",
  "tree": "19b63eb841e38421674b70e422d5b0bd863f41f2",
  "parents": [
    "b9876e6de123adb52ac693bac08c493e989bd93e"
  ],
  "author": {
    "name": "Sean Christopherson",
    "email": "sean.j.christopherson@intel.com",
    "time": "Wed Nov 13 11:30:32 2019 -0800"
  },
  "committer": {
    "name": "Paolo Bonzini",
    "email": "pbonzini@redhat.com",
    "time": "Thu Nov 14 16:21:22 2019 +0100"
  },
  "message": "KVM: x86/mmu: Take slots_lock when using kvm_mmu_zap_all_fast()\n\nAcquire the per-VM slots_lock when zapping all shadow pages as part of\ntoggling nx_huge_pages.  The fast zap algorithm relies on exclusivity\n(via slots_lock) to identify obsolete vs. valid shadow pages, because it\nuses a single bit for its generation number. Holding slots_lock also\nobviates the need to acquire a read lock on the VM\u0027s srcu.\n\nFailing to take slots_lock when toggling nx_huge_pages allows multiple\ninstances of kvm_mmu_zap_all_fast() to run concurrently, as the other\nuser, KVM_SET_USER_MEMORY_REGION, does not take the global kvm_lock.\n(kvm_mmu_zap_all_fast() does take kvm-\u003emmu_lock, but it can be\ntemporarily dropped by kvm_zap_obsolete_pages(), so it is not enough\nto enforce exclusivity).\n\nConcurrent fast zap instances causes obsolete shadow pages to be\nincorrectly identified as valid due to the single bit generation number\nwrapping, which results in stale shadow pages being left in KVM\u0027s MMU\nand leads to all sorts of undesirable behavior.\nThe bug is easily confirmed by running with CONFIG_PROVE_LOCKING and\ntoggling nx_huge_pages via its module param.\n\nNote, until commit 4ae5acbc4936 (\"KVM: x86/mmu: Take slots_lock when\nusing kvm_mmu_zap_all_fast()\", 2019-11-13) the fast zap algorithm used\nan ulong-sized generation instead of relying on exclusivity for\ncorrectness, but all callers except the recently added set_nx_huge_pages()\nneeded to hold slots_lock anyways.  Therefore, this patch does not have\nto be backported to stable kernels.\n\nGiven that toggling nx_huge_pages is by no means a fast path, force it\nto conform to the current approach instead of reintroducing the previous\ngeneration count.\n\nFixes: b8e8c8303ff28 (\"kvm: mmu: ITLB_MULTIHIT mitigation\", but NOT FOR STABLE)\nSigned-off-by: Sean Christopherson \u003csean.j.christopherson@intel.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cf718fa23dffff0a41e0c8a71a8342277ae6a983",
      "old_mode": 33188,
      "old_path": "arch/x86/kvm/mmu.c",
      "new_id": "2ce9da58611ed7c8739b4f6cf6c7679eaceedc24",
      "new_mode": 33188,
      "new_path": "arch/x86/kvm/mmu.c"
    }
  ]
}