From: James Houghton <jthoughton@google•com>
To: Paolo Bonzini <pbonzini@redhat•com>
Cc: Marc Zyngier <maz@kernel•org>, Oliver Upton <oupton@kernel•org>,
Joey Gouly <joey.gouly@arm•com>,
Suzuki K Poulose <suzuki.poulose@arm•com>,
Zenghui Yu <yuzenghui@huawei•com>,
Sean Christopherson <seanjc@google•com>,
Gavin Shan <gshan@redhat•com>,
Shaoqin Huang <shahuang@redhat•com>,
Ricardo Koller <ricarkol@google•com>,
Tianrui Zhao <zhaotianrui@loongson•cn>,
Bibo Mao <maobibo@loongson•cn>,
Huacai Chen <chenhuacai@kernel•org>,
James Hogan <jhogan@kernel•org>,
linux-arm-kernel@lists•infradead.org, kvmarm@lists•linux.dev,
loongarch@lists•linux.dev, linux-mips@vger•kernel.org,
kvm@vger•kernel.org, linux-kernel@vger•kernel.org,
James Houghton <jthoughton@google•com>,
stable@vger•kernel.org
Subject: [PATCH 3/5] KVM: mips: Grab MMU lock in kvm_arch_flush_shadow_all()
Date: Mon, 4 May 2026 22:42:10 +0000 [thread overview]
Message-ID: <20260504224213.1049426-4-jthoughton@google.com> (raw)
In-Reply-To: <20260504224213.1049426-1-jthoughton@google.com>
kvm_mips_flush_gpa_pt() expects the MMU lock to be held; it is not in
this path.
This can lead to a double-free of page table entries if
kvm_arch_flush_shadow_all() is called twice on the same `kvm`
concurrently; such a scenario is possible.
Cc: stable@vger•kernel.org
Fixes: b62091108633 ("KVM: MIPS: Implement kvm_arch_flush_shadow_all/memslot")
Signed-off-by: James Houghton <jthoughton@google•com>
---
Note: This is compile-tested only!
arch/mips/kvm/mips.c | 2 ++
arch/mips/kvm/mmu.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index a53abbba43ea..463b6c4aa62c 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -180,6 +180,8 @@ long kvm_arch_dev_ioctl(struct file *filp, unsigned int ioctl,
void kvm_arch_flush_shadow_all(struct kvm *kvm)
{
+ guard(spinlock)(&kvm->mmu_lock);
+
/* Flush whole GPA */
kvm_mips_flush_gpa_pt(kvm, 0, ~0);
kvm_flush_remote_tlbs(kvm);
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index d2c3b6b41f18..5045833f8116 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -269,6 +269,8 @@ static bool kvm_mips_flush_gpa_pgd(pgd_t *pgd, unsigned long start_gpa,
*/
bool kvm_mips_flush_gpa_pt(struct kvm *kvm, gfn_t start_gfn, gfn_t end_gfn)
{
+ lockdep_assert_held(&kvm->mmu_lock);
+
return kvm_mips_flush_gpa_pgd(kvm->arch.gpa_mm.pgd,
start_gfn << PAGE_SHIFT,
end_gfn << PAGE_SHIFT);
--
2.54.0.545.g6539524ca2-goog
next prev parent reply other threads:[~2026-05-04 22:42 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-04 22:42 [PATCH 0/5] KVM: Fix race conditions in kvm_arch_flush_shadow_all() James Houghton
2026-05-04 22:42 ` [PATCH 1/5] KVM: arm64: Grab KVM MMU write lock " James Houghton
2026-05-04 23:10 ` James Houghton
2026-05-05 17:05 ` Sean Christopherson
2026-05-05 18:01 ` James Houghton
2026-05-05 18:16 ` Sean Christopherson
2026-05-05 20:14 ` Sean Christopherson
2026-05-06 2:27 ` Bibo Mao
2026-05-06 13:55 ` Sean Christopherson
2026-05-07 1:40 ` Bibo Mao
2026-05-04 22:42 ` [PATCH 2/5] KVM: loongarch: Grab MMU " James Houghton
2026-05-08 7:21 ` Bibo Mao
2026-05-04 22:42 ` James Houghton [this message]
2026-05-04 22:42 ` [PATCH 4/5] KVM: Hold MMU lock exclusively when calling kvm_arch_flush_shadow_all() James Houghton
2026-05-04 22:42 ` [PATCH 5/5] DO NOT MERGE: KVM: selftests: Reproducer for arm64 double-free James Houghton
2026-05-04 22:44 ` [PATCH 0/5] KVM: Fix race conditions in kvm_arch_flush_shadow_all() James Houghton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260504224213.1049426-4-jthoughton@google.com \
--to=jthoughton@google$(echo .)com \
--cc=chenhuacai@kernel$(echo .)org \
--cc=gshan@redhat$(echo .)com \
--cc=jhogan@kernel$(echo .)org \
--cc=joey.gouly@arm$(echo .)com \
--cc=kvm@vger$(echo .)kernel.org \
--cc=kvmarm@lists$(echo .)linux.dev \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-mips@vger$(echo .)kernel.org \
--cc=loongarch@lists$(echo .)linux.dev \
--cc=maobibo@loongson$(echo .)cn \
--cc=maz@kernel$(echo .)org \
--cc=oupton@kernel$(echo .)org \
--cc=pbonzini@redhat$(echo .)com \
--cc=ricarkol@google$(echo .)com \
--cc=seanjc@google$(echo .)com \
--cc=shahuang@redhat$(echo .)com \
--cc=stable@vger$(echo .)kernel.org \
--cc=suzuki.poulose@arm$(echo .)com \
--cc=yuzenghui@huawei$(echo .)com \
--cc=zhaotianrui@loongson$(echo .)cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox