Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3759372pxt; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwU8JZ5IA/8WJ1y4Odz4fd0DW7xQo9lO7p8J3XevuRgtIM0qYYoJRXa7/FPPQfczVcQfHbb X-Received: by 2002:a05:6402:328:: with SMTP id q8mr905101edw.84.1628617167133; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628617167; cv=none; d=google.com; s=arc-20160816; b=ZNFFyvnOioI+JKd9FWBi7LFQBM3nQK/l21KZE/+byABPKMHMybDE8avI2gjXViyfvV 8tRaovVueUB08KBqTMStgPtLqvx0HdPPlrvQYGdPSTe+WDPjnUjckSr1mqB/coPjGcvd hSXep5fyikkr+AnSJe7EeOGmLpvsEiqRCJHjoz5U3SoMWE6x9ZKt+nX3IC8g4rhqXVSV pch80rr6xw/Np2KmESXem4+WvIb/pldYW1IhQoiooudlXd5xP7xWFkscdvXr0s80MiPh CO0Ss8cdFvL9/5iRY4RVqzCC9nHracIVFbXtdluQWw9jr/QJWwFMa/WVPXs9xMmg3S7z sm+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=OkC58HlMLHaKAPaU+usu4Is3FJxX150Cv5O+UD4cD60=; b=IrkWS4W0f5A7TCIbFPU+6+K1vbE1TsCtK3oDnR2ksHpc6cG1SNPlK4jwsz29rPT6Go 7BA6Sonr+1XOHVQzcRApkcHy2VtAGUv4uQURwKyPYG4Ln86ndoBt4dqNlF0Tm6HIyO6f e2P0OaWuf0wRmNJ5ZywlbciR4r7VbnL5wc1DLIJFWKBH5olX/TsLF9mNBSG8mnYUgMAx RVBI9ERoo04IIBdUIm+P1ZIUMX9jYy65UF+Hrf5sWtJoW+kadEduR6bno1dgHHkx/UgS 12vVZAXv+3q2mxzYQqZFmbKO65gwV8APyOXKeoauSCsQA1c0g8JsFIf1kn7V4YvrPubj PxuQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=J1noYsVO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e24si7146431edq.444.2021.08.10.10.39.02; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=J1noYsVO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232574AbhHJRei (ORCPT + 99 others); Tue, 10 Aug 2021 13:34:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:35348 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232827AbhHJRdv (ORCPT ); Tue, 10 Aug 2021 13:33:51 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 17ECB61058; Tue, 10 Aug 2021 17:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628616809; bh=xvFd2K8Cj1moFOA5Q2nGdV2VZIP7mef1IQrDR9e6hDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J1noYsVO6DbRGrswtDB+TYGmxuCMCbjw5PIVLs+vfZet4GtzxTxswlCrKP1Iu1ni9 HlWg4nLBzf6sK077lEg1/35Y0WYsqtER+Zgd+2w87XW3tt+gPsaZRY27wwCM0c7cdS wWIzAa9twz+ZiSV9CdhkgEF7HaczU4qEPUARlNU4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Gardon , Sean Christopherson , Jim Mattson , Paolo Bonzini Subject: [PATCH 4.19 45/54] KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds Date: Tue, 10 Aug 2021 19:30:39 +0200 Message-Id: <20210810172945.680686881@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810172944.179901509@linuxfoundation.org> References: <20210810172944.179901509@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sean Christopherson commit d5aaad6f83420efb8357ac8e11c868708b22d0a9 upstream. Take a signed 'long' instead of an 'unsigned long' for the number of pages to add/subtract to the total number of pages used by the MMU. This fixes a zero-extension bug on 32-bit kernels that effectively corrupts the per-cpu counter used by the shrinker. Per-cpu counters take a signed 64-bit value on both 32-bit and 64-bit kernels, whereas kvm_mod_used_mmu_pages() takes an unsigned long and thus an unsigned 32-bit value on 32-bit kernels. As a result, the value used to adjust the per-cpu counter is zero-extended (unsigned -> signed), not sign-extended (signed -> signed), and so KVM's intended -1 gets morphed to 4294967295 and effectively corrupts the counter. This was found by a staggering amount of sheer dumb luck when running kvm-unit-tests on a 32-bit KVM build. The shrinker just happened to kick in while running tests and do_shrink_slab() logged an error about trying to free a negative number of objects. The truly lucky part is that the kernel just happened to be a slightly stale build, as the shrinker no longer yells about negative objects as of commit 18bb473e5031 ("mm: vmscan: shrink deferred objects proportional to priority"). vmscan: shrink_slab: mmu_shrink_scan+0x0/0x210 [kvm] negative objects to delete nr=-858993460 Fixes: bc8a3d8925a8 ("kvm: mmu: Fix overflow on kvm mmu page limit calculation") Cc: stable@vger.kernel.org Cc: Ben Gardon Signed-off-by: Sean Christopherson Message-Id: <20210804214609.1096003-1-seanjc@google.com> Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -2042,7 +2042,7 @@ static int is_empty_shadow_page(u64 *spt * aggregate version in order to make the slab shrinker * faster */ -static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr) +static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, long nr) { kvm->arch.n_used_mmu_pages += nr; percpu_counter_add(&kvm_total_used_mmu_pages, nr);