In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: Fix spurious warning for benign stage 2 teardown race<\/p>\n
kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an
\nL2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB
\nof RAM, all of which was then exited.<\/p>\n
Under memory pressure in the L0 host warnings were observed due to
\nmigration triggered by compaction:<\/p>\n
WARNING: arch\/arm64\/kvm\/mmu.c:336 at __unmap_stage2_range+0x64\/0x80,
\nCPU#5: kcompactd0\/66<\/p>\n
Which was, in turn, triggered by an MMU notifier for the host invalidation:<\/p>\n
mmu_notifier_invalidate_range_start()
\n -> … -> kvm_mmu_notifier_invalidate_range_start()
\n -> kvm_mmu_unmap_gfn_range()
\n -> kvm_unmap_gfn_range()
\n -> kvm_nested_s2_unmap()
\n -> kvm_stage2_unmap_range()
\n -> __unmap_stage2_range()
\n -> stage2_apply_range()
\n \t mmput()
\n -> __mmput()
\n -> exit_mmap()
\n -> mmu_notifier_release()
\n\t -> … -> kvm_mmu_notifier_release()
\n -> kvm_flush_shadow_all()
\n -> kvm_arch_flush_shadow_all()
\n\t -> kvm_free_stage2_pgd()
\n\t\t -> [ acquire kvm->mmu_lock for write ]
\n\t\t -> mmu->pgt = NULL [ among other tasks ]
\n\t\t -> [ release kvm->mmu_lock for write ]<\/p>\n
It turns out there is a benign race resulting in a spurious warning:<\/p>\n
\tThread A – notify: migration | Thread B – notify: release
\n\t——————————-|———————————
\n\tmmu_lock held > |
\n\tstage2_apply_range() |
\n\t get mmu->pgt, check !NULL |
\n\t … | kvm_arch_flush_shadow_all()
\n\t cond_resched_rwlock_write(); | mmu_lock >
\n\tmmu_lock > | mmu_lock>
\n | …
\n\t\t\t\t | kvm_free_stage2_pgd()
\n | mmu->pgt = NULL
\n\t\t\t\t |
\n\t\t\t\t | …
\n\t\t\t\t | mmu_lock >
\n\t[ scheduled ]\t\t |
\n\tstage2_apply_range() |
\n\t |
\n\t get, mmu->pgt, check !NULL |
\n\t is NULL, return -EINVAL |
\n __unmap_stage2_range() |
\n\t WARN_ON(-EINVAL) <— entirely spurious – the race was handled
\n correctly.<\/p>\n
Fix the spurious warning by updating stage2_apply_range() to no longer
\ntreat concurrent PGT teardown on lock release as an error – whether the
\nwalker is tearing down page tables or doing something else this is a
\nlegitimate reason to abort the operation without error.<\/p>\n
This keeps the warning in place for all other circumstances.<\/p>\n
In practice only __unmap_stage2_range() actually does anything with the
\nerror so this only impacts that.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: Fix spurious warning for benign stage 2 teardown race<\/p>\n
kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40940","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}