Hi Narayana,
Narayana Murty N <[email protected]> writes: > Commit cad32d9d42e8 ("KVM: PPC: Book3s: Retire H_PUT_TCE/etc real mode > handlers") moved the TCE hcalls from real mode to preemptible virtual > mode. > > The stt->iommu_tables list is RCU managed. Entries are added with > list_add_rcu(), removed with list_del_rcu(), and released after an RCU > grace period with call_rcu(). > > However, kvmppc_h_put_tce(), kvmppc_h_put_tce_indirect(), and > kvmppc_h_stuff_tce() traverse iommu_tables using > list_for_each_entry_lockless() without an RCU read-side critical > section. > > A concurrent IOMMU table detach can therefore remove an entry while a > TCE hcall is traversing or using it, without the traversal preventing > the entry from being reclaimed. > > Use list_for_each_entry_rcu() under rcu_read_lock() for these walks so > that an entry removed concurrently is not reclaimed until the reader > has completed. > > Fixes: cad32d9d42e8 ("KVM: PPC: Book3s: Retire H_PUT_TCE/etc real mode > handlers") I am not sure if this is the right fix. On doing git blame, I see the following patch introduced this: 121f80ba ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO") - Alexey Kardashevskiy > Cc: [email protected] > Signed-off-by: Narayana Murty N <[email protected]> > --- > arch/powerpc/kvm/book3s_64_vio.c | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) Sashiko pointed out few more bugs around this path: Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] kvm: ppc: UAF of spapr_tce_table due to missing rcu_read_lock() - [High] kvmppc_clear_tce: pinned memory leak on partial IOMMU map failure So, even though these looks to be pre-existing bugs - do you think we can address them in a single patch series itself? This will reduce your testing/validation as well? Also since we are anyway fixing RCU specific bugs in patch-1, so I think we can also fix rcu handling for stt as well? Do you mind working on v2 and addressing Sashiko review comments please? -ritesh
