Skip to content

Commit 09ca8e1

Browse files
awilliamgregkh
authored andcommitted
KVM: unmap pages from the iommu when slots are removed
commit 32f6daa upstream. We've been adding new mappings, but not destroying old mappings. This can lead to a page leak as pages are pinned using get_user_pages, but only unpinned with put_page if they still exist in the memslots list on vm shutdown. A memslot that is destroyed while an iommu domain is enabled for the guest will therefore result in an elevated page reference count that is never cleared. Additionally, without this fix, the iommu is only programmed with the first translation for a gpa. This can result in peer-to-peer errors if a mapping is destroyed and replaced by a new mapping at the same gpa as the iommu will still be pointing to the original, pinned memory address. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent f16e3ad commit 09ca8e1

File tree

3 files changed

+15
-3
lines changed

3 files changed

+15
-3
lines changed

Diff for: include/linux/kvm_host.h

+6
Original file line numberDiff line numberDiff line change
@@ -593,6 +593,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
593593

594594
#ifdef CONFIG_IOMMU_API
595595
int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
596+
void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
596597
int kvm_iommu_map_guest(struct kvm *kvm);
597598
int kvm_iommu_unmap_guest(struct kvm *kvm);
598599
int kvm_assign_device(struct kvm *kvm,
@@ -606,6 +607,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
606607
return 0;
607608
}
608609

610+
static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
611+
struct kvm_memory_slot *slot)
612+
{
613+
}
614+
609615
static inline int kvm_iommu_map_guest(struct kvm *kvm)
610616
{
611617
return -ENODEV;

Diff for: virt/kvm/iommu.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
310310
}
311311
}
312312

313+
void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
314+
{
315+
kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
316+
}
317+
313318
static int kvm_iommu_unmap_memslots(struct kvm *kvm)
314319
{
315320
int idx;
@@ -320,7 +325,7 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
320325
slots = kvm_memslots(kvm);
321326

322327
kvm_for_each_memslot(memslot, slots)
323-
kvm_iommu_put_pages(kvm, memslot->base_gfn, memslot->npages);
328+
kvm_iommu_unmap_pages(kvm, memslot);
324329

325330
srcu_read_unlock(&kvm->srcu, idx);
326331

Diff for: virt/kvm/kvm_main.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -873,12 +873,13 @@ int __kvm_set_memory_region(struct kvm *kvm,
873873
if (r)
874874
goto out_free;
875875

876-
/* map the pages in iommu page table */
876+
/* map/unmap the pages in iommu page table */
877877
if (npages) {
878878
r = kvm_iommu_map_pages(kvm, &new);
879879
if (r)
880880
goto out_free;
881-
}
881+
} else
882+
kvm_iommu_unmap_pages(kvm, &old);
882883

883884
r = -ENOMEM;
884885
slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),

0 commit comments

Comments
 (0)