On Tue, Dec 17, 2019 at 05:24:46PM -0500, Peter Xu wrote:
> On Tue, Dec 17, 2019 at 12:40:29PM -0800, Sean Christopherson wrote:
> > Explicitly free an allocated-but-unused dirty bitmap instead of relying
> > on kvm_free_memslot() if an error occurs in __kvm_set_memory_region().
> > There is no longer a need to abuse kvm_free_memslot() to free arch
> > specific resources as arch specific code is now called only after the
> > common flow is guaranteed to succeed. Arch code can still fail, but
> > it's responsible for its own cleanup in that case.
> >
> > Eliminating the error path's abuse of kvm_free_memslot() paves the way
> > for simplifying kvm_free_memslot(), i.e. dropping its @dont param.
> >
> > Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
> > ---
> > virt/kvm/kvm_main.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index d403e93e3028..6b2261a9e139 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -1096,7 +1096,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
> >
> > slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL_ACCOUNT);
> > if (!slots)
> > - goto out_free;
> > + goto out_bitmap;
> > memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
> >
> > if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
> > @@ -1144,8 +1144,9 @@ int __kvm_set_memory_region(struct kvm *kvm,
> > if (change == KVM_MR_DELETE || change == KVM_MR_MOVE)
> > slots = install_new_memslots(kvm, as_id, slots);
> > kvfree(slots);
> > -out_free:
> > - kvm_free_memslot(kvm, &new, &old);
> > +out_bitmap:
> > + if (new.dirty_bitmap && !old.dirty_bitmap)
> > + kvm_destroy_dirty_bitmap(&new);
>
> What if both the old and new have KVM_MEM_LOG_DIRTY_PAGES set?
> kvm_free_memslot() did cover that but I see that you explicitly
> dropped it. Could I ask why? Thanks,
In that case, old.dirty_bitmap == new.dirty_bitmap, i.e. shouldn't be freed
by this error path since doing so would result in a use-after-free via the
old memslot.
The kvm_free_memslot() logic is the same, albeit in a very twisted way.
In __kvm_set_memory_region(), @old and @new start with the same dirty_bitmap.
new = old = *slot;
And @new is modified based on KVM_MEM_LOG_DIRTY_PAGES. If LOG_DIRTY_PAGES
is set in both @new and @old, then both the "if" and "else if" evaluate
false, i.e. new.dirty_bitmap == old.dirty_bitmap.
/* Allocate/free page dirty bitmap as needed */
if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
new.dirty_bitmap = NULL;
else if (!new.dirty_bitmap) {
r = kvm_create_dirty_bitmap(&new);
if (r)
return r;
}
Subbing "@free <= @new" and "@dont <= @old" in kvm_free_memslot()
static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
struct kvm_memory_slot *dont)
{
if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
kvm_destroy_dirty_bitmap(free);
yeids this, since @old is obviously non-NULL
if (new.dirty_bitmap != old.dirty_bitmap)
kvm_destroy_dirty_bitmap(&new);
The dirty_bitmap allocation logic guarantees that new.dirty_bitmap is
a) NULL (the "if" case")
b) != old.dirty_bitmap iff old.dirty_bitmap == NULL (the "else if" case)
c) == old.dirty_bitmap (the implicit "else" case).
kvm_free_memslot() frees @new.dirty_bitmap iff its != @old.dirty_bitmap,
thus the explicit destroy only needs to check for (b).
