• Takuya Yoshikawa's avatar
    KVM: Fix __set_bit() race in mark_page_dirty() during dirty logging · 50e92b3c
    Takuya Yoshikawa authored
    It is possible that the __set_bit() in mark_page_dirty() is called
    simultaneously on the same region of memory, which may result in only
    one bit being set, because some callers do not take mmu_lock before
    mark_page_dirty().
    
    This problem is hard to produce because when we reach mark_page_dirty()
    beginning from, e.g., tdp_page_fault(), mmu_lock is being held during
    __direct_map():  making kvm-unit-tests' dirty log api test write to two
    pages concurrently was not useful for this reason.
    
    So we have confirmed that there can actually be race condition by
    checking if some callers really reach there without holding mmu_lock
    using spin_is_locked():  probably they were from kvm_write_guest_page().
    
    To fix this race, this patch changes the bit operation to the atomic
    version:  note that nr_dirty_pages also suffers from the race but we do
    not need exactly correct numbers for now.
    Signed-off-by: default avatarTakuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
    Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
    50e92b3c
kvm_main.c 62.5 KB