KVM: Fix missing smp tlb flush in invlpg

upstream commit: 4539b35881ae9664b0e2953438dd83f5ee02c0b4

When kvm emulates an invlpg instruction, it can drop a shadow pte, but
leaves the guest tlbs intact.  This can cause memory corruption when
swapping out.

Without this the other cpu can still write to a freed host physical page.
tlb smp flush must happen if rmap_remove is called always before mmu_lock
is released because the VM will take the mmu_lock before it can finally add
the page to the freelist after swapout. mmu notifier makes it safe to flush
the tlb after freeing the page (otherwise it would never be safe) so we can do
a single flush for multiple sptes invalidated.

Cc: stable@kernel.org
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
[mtosatti: backport to 2.6.29]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index c95a67df5906d4b35105012d4f327f4fc41f9fbd..89addbd4253920eba6bafa6da6f2b4c3c56ac10e 100644 (file)
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -476,16 +476,20 @@ static int FNAME(shadow_invlpg_entry)(struct kvm_shadow_walk *_sw,
        if (level == PT_PAGE_TABLE_LEVEL ||
            ((level == PT_DIRECTORY_LEVEL) && is_large_pte(*sptep))) {
                struct kvm_mmu_page *sp = page_header(__pa(sptep));
+               int need_flush = 0;
 
                sw->pte_gpa = (sp->gfn << PAGE_SHIFT);
                sw->pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
 
                if (is_shadow_present_pte(*sptep)) {
+                       need_flush = 1;
                        rmap_remove(vcpu->kvm, sptep);
                        if (is_large_pte(*sptep))
                                --vcpu->kvm->stat.lpages;
                }
                set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
+               if (need_flush)
+                       kvm_flush_remote_tlbs(vcpu->kvm);
                return 1;
        }
        if (!is_shadow_present_pte(*sptep))