lkml.org 
[lkml]   [2018]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 119/254] KVM: arm/arm64: Fix HYP unmapping going off limits
    3.16.55-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Marc Zyngier <marc.zyngier@arm.com>

    commit 7839c672e58bf62da8f2f0197fefb442c02ba1dd upstream.

    When we unmap the HYP memory, we try to be clever and unmap one
    PGD at a time. If we start with a non-PGD aligned address and try
    to unmap a whole PGD, things go horribly wrong in unmap_hyp_range
    (addr and end can never match, and it all goes really badly as we
    keep incrementing pgd and parse random memory as page tables...).

    The obvious fix is to let unmap_hyp_range do what it does best,
    which is to iterate over a range.

    The size of the linear mapping, which begins at PAGE_OFFSET, can be
    easily calculated by subtracting PAGE_OFFSET form high_memory, because
    high_memory is defined as the linear map address of the last byte of
    DRAM, plus one.

    The size of the vmalloc region is given trivially by VMALLOC_END -
    VMALLOC_START.

    Reported-by: Andre Przywara <andre.przywara@arm.com>
    Tested-by: Andre Przywara <andre.przywara@arm.com>
    Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
    Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
    [bwh: Backported to 3.16: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    arch/arm/kvm/mmu.c | 10 ++++------
    1 file changed, 4 insertions(+), 6 deletions(-)

    --- a/arch/arm/kvm/mmu.c
    +++ b/arch/arm/kvm/mmu.c
    @@ -345,17 +345,15 @@ void free_boot_hyp_pgd(void)
    */
    void free_hyp_pgds(void)
    {
    - unsigned long addr;
    -
    free_boot_hyp_pgd();

    mutex_lock(&kvm_hyp_pgd_mutex);

    if (hyp_pgd) {
    - for (addr = PAGE_OFFSET; virt_addr_valid(addr); addr += PGDIR_SIZE)
    - unmap_range(NULL, hyp_pgd, KERN_TO_HYP(addr), PGDIR_SIZE);
    - for (addr = VMALLOC_START; is_vmalloc_addr((void*)addr); addr += PGDIR_SIZE)
    - unmap_range(NULL, hyp_pgd, KERN_TO_HYP(addr), PGDIR_SIZE);
    + unmap_range(NULL, hyp_pgd, KERN_TO_HYP(PAGE_OFFSET),
    + (uintptr_t)high_memory - PAGE_OFFSET);
    + unmap_range(NULL, hyp_pgd, KERN_TO_HYP(VMALLOC_START),
    + VMALLOC_END - VMALLOC_START);

    free_pages((unsigned long)hyp_pgd, pgd_order);
    hyp_pgd = NULL;
    \
     
     \ /
      Last update: 2018-02-28 17:13    [W:4.098 / U:0.472 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site