Re: KVM: MMU: avoid creation of unreachable pages in the shadow

[Marcelo Tosatti]

On Tue, Nov 25, 2008 at 01:27:27PM -0500, John Rousseau wrote:
> Marcelo Tosatti wrote:
>> It is possible for a shadow page to have a parent link
>> pointing to a freed page. When zapping a high level table,
>> kvm_mmu_page_unlink_children fails to remove the parent_pte link.
>> For that to happen, the child must be unreachable via the shadow tree, 
>> which can happen in shadow_walk_entry if the guest pte was
>> modified in between walk() and fetch(). Remove the parent pte  
>> reference in such case.
>>
>> Possible cause for oops in bug #2217430.
>
> I'll apply this to the code that I'm testing, but with my change to  
> 2.6.27, kvm-79 and Avi's patch from bug #2217430, I haven't seen the  
> problem again. I still have been testing with oos_shadow=0, which I'll  
> get rid of now.

John, 

Please use the attached patch in addition (and drop Avi's). What
is the application set you use to reproduce these issues (that you
mentioned in the bugtrack) ?

Thanks



diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 0813a08..8904e8a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1046,13 +1046,13 @@ static int kvm_sync_page(struct kvm_vcpu *vcpu, struct 
kvm_mmu_page *sp)
        }
 
        rmap_write_protect(vcpu->kvm, sp->gfn);
+       kvm_unlink_unsync_page(vcpu->kvm, sp);
        if (vcpu->arch.mmu.sync_page(vcpu, sp)) {
                kvm_mmu_zap_page(vcpu->kvm, sp);
                return 1;
        }
 
        kvm_mmu_flush_tlb(vcpu);
-       kvm_unlink_unsync_page(vcpu->kvm, sp);
        return 0;
 }