KVM: fix error paths for failed gfn_to_page() calls
authorXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Fri, 7 Sep 2012 06:14:20 +0000 (14:14 +0800)
committerAvi Kivity <avi@redhat.com>
Mon, 10 Sep 2012 08:34:11 +0000 (11:34 +0300)
commit4484141a94f4a5afea6ebc0b2abba0aa1b0ae9d1
tree8618326f0e327bf06973e25333e1682f1fb7a8b5
parent4f97704555672f9ab48ca623561e96a9430bec9a
KVM: fix error paths for failed gfn_to_page() calls

This bug was triggered:
[ 4220.198458] BUG: unable to handle kernel paging request at fffffffffffffffe
[ 4220.203907] IP: [<ffffffff81104d85>] put_page+0xf/0x34
......
[ 4220.237326] Call Trace:
[ 4220.237361]  [<ffffffffa03830d0>] kvm_arch_destroy_vm+0xf9/0x101 [kvm]
[ 4220.237382]  [<ffffffffa036fe53>] kvm_put_kvm+0xcc/0x127 [kvm]
[ 4220.237401]  [<ffffffffa03702bc>] kvm_vcpu_release+0x18/0x1c [kvm]
[ 4220.237407]  [<ffffffff81145425>] __fput+0x111/0x1ed
[ 4220.237411]  [<ffffffff8114550f>] ____fput+0xe/0x10
[ 4220.237418]  [<ffffffff81063511>] task_work_run+0x5d/0x88
[ 4220.237424]  [<ffffffff8104c3f7>] do_exit+0x2bf/0x7ca

The test case:

printf(fmt, ##args); \
exit(-1);} while (0)

static int create_vm(void)
{
int sys_fd, vm_fd;

sys_fd = open("/dev/kvm", O_RDWR);
if (sys_fd < 0)
die("open /dev/kvm fail.\n");

vm_fd = ioctl(sys_fd, KVM_CREATE_VM, 0);
if (vm_fd < 0)
die("KVM_CREATE_VM fail.\n");

return vm_fd;
}

static int create_vcpu(int vm_fd)
{
int vcpu_fd;

vcpu_fd = ioctl(vm_fd, KVM_CREATE_VCPU, 0);
if (vcpu_fd < 0)
die("KVM_CREATE_VCPU ioctl.\n");
printf("Create vcpu.\n");
return vcpu_fd;
}

static void *vcpu_thread(void *arg)
{
int vm_fd = (int)(long)arg;

create_vcpu(vm_fd);
return NULL;
}

int main(int argc, char *argv[])
{
pthread_t thread;
int vm_fd;

(void)argc;
(void)argv;

vm_fd = create_vm();
pthread_create(&thread, NULL, vcpu_thread, (void *)(long)vm_fd);
printf("Exit.\n");
return 0;
}

It caused by release kvm->arch.ept_identity_map_addr which is the
error page.

The parent thread can send KILL signal to the vcpu thread when it was
exiting which stops faulting pages and potentially allocating memory.
So gfn_to_pfn/gfn_to_page may fail at this time

Fixed by checking the page before it is used

Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
arch/x86/kvm/vmx.c
arch/x86/kvm/x86.c