Eiichi Tsukata e649b3f018 KVM: x86: Fix APIC page invalidation race ... Commit b1394e745b ("KVM: x86: fix APIC page invalidation") tried to fix inappropriate APIC page invalidation by re-introducing arch specific kvm_arch_mmu_notifier_invalidate_range() and calling it from kvm_mmu_notifier_invalidate_range_start. However, the patch left a possible race where the VMCS APIC address cache is updated *before* it is unmapped: (Invalidator) kvm_mmu_notifier_invalidate_range_start() (Invalidator) kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD) (KVM VCPU) vcpu_enter_guest() (KVM VCPU) kvm_vcpu_reload_apic_access_page() (Invalidator) actually unmap page Because of the above race, there can be a mismatch between the host physical address stored in the APIC_ACCESS_PAGE VMCS field and the host physical address stored in the EPT entry for the APIC GPA (0xfee0000). When this happens, the processor will not trap APIC accesses, and will instead show the raw contents of the APIC-access page. Because Windows OS periodically checks for unexpected modifications to the LAPIC register, this will show up as a BSOD crash with BugCheck CRITICAL_STRUCTURE_CORRUPTION (109) we are currently seeing in https://bugzilla.redhat.com/show_bug.cgi?id=1751017. The root cause of the issue is that kvm_arch_mmu_notifier_invalidate_range() cannot guarantee that no additional references are taken to the pages in the range before kvm_mmu_notifier_invalidate_range_end(). Fortunately, this case is supported by the MMU notifier API, as documented in include/linux/mmu_notifier.h: * If the subsystem * can't guarantee that no additional references are taken to * the pages in the range, it has to implement the * invalidate_range() notifier to remove any references taken * after invalidate_range_start(). The fix therefore is to reload the APIC-access page field in the VMCS from kvm_mmu_notifier_invalidate_range() instead of ..._range_start(). Cc: stable@vger.kernel.org Fixes: b1394e745b ("KVM: x86: fix APIC page invalidation") Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=197951 Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com> Message-Id: <20200606042627.61070-1-eiichi.tsukata@nutanix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2020-06-08 09:05:38 -04:00
..
acpi	Merge branches 'acpi-apei', 'acpi-pmic', 'acpi-video' and 'acpi-dptf'	2020-06-01 17:19:43 +02:00
asm-generic	Merge branch 'akpm' (patches from Andrew)	2020-06-03 20:24:15 -07:00
clocksource	…
crypto	crypto: lib/sha1 - fold linux/cryptohash.h into crypto/sha.h	2020-05-08 15:32:17 +10:00
drm	drm pull for 5.8-rc1	2020-06-02 15:04:15 -07:00
dt-bindings	…
keys	…
kunit	…
kvm	KVM: arm64: vgic-v3: Take cpu_if pointer directly instead of vcpu	2020-05-28 11:57:10 +01:00
linux	KVM: x86: Fix APIC page invalidation race	2020-06-08 09:05:38 -04:00
math-emu	…
media	media updates for v5.8-rc1	2020-06-03 20:59:38 -07:00
misc	…
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-06-03 16:27:18 -07:00
pcmcia	…
ras	…
rdma	RDMA/core: Fix double destruction of uobject	2020-05-27 14:22:57 -03:00
scsi	block: move dma_pad handling from blk_rq_map_sg into the callers	2020-04-22 10:47:39 -06:00
soc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-05-06 22:10:13 -07:00
sound	ALSA: rawmidi: Fix racy buffer resize under concurrent accesses	2020-05-07 22:29:14 +02:00
target	…
trace	Merge branch 'akpm' (patches from Andrew)	2020-06-03 20:24:15 -07:00
uapi	media updates for v5.8-rc1	2020-06-03 20:59:38 -07:00
vdso	vdso/datapage: Use correct clock mode name in comment	2020-04-20 19:19:52 +02:00
video	…
xen	…