Commit 98db7259 authored Jun 24, 2021 by Marc Zyngier

KVM: arm64: Set the MTE tag bit before releasing the page



Setting a page flag without holding a reference to the page
is living dangerously. In the tag-writing path, we drop the
reference to the page by calling kvm_release_pfn_dirty(),
and only then set the PG_mte_tagged bit.

It would be safer to do it the other way round.

Fixes: f0376edb ("KVM: arm64: Add ioctl to fetch/store tags in a guest")
Cc: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/87k0mjidwb.wl-maz@kernel.org

parent 04c02c20

arch/arm64/kvm/guest.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -1053,6 +1053,14 @@ long kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,
		} else {
		num_tags = mte_copy_tags_from_user(maddr, tags,
		MTE_GRANULES_PER_PAGE);

		/*
		* Set the flag after checking the write
		* completed fully
		*/
		if (num_tags == MTE_GRANULES_PER_PAGE)
		set_bit(PG_mte_tagged, &page->flags);

		kvm_release_pfn_dirty(pfn);
		}

		@@ -1061,10 +1069,6 @@ long kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,
		goto out;
		}

		/* Set the flag after checking the write completed fully */
		if (write)
		set_bit(PG_mte_tagged, &page->flags);

		gfn++;
		tags += num_tags;
		length -= PAGE_SIZE;