Message-ID: <20eddd70-7abb-e1a8-a003-62ed08fc1cac@redhat.com>
Date:   Wed, 17 Nov 2021 17:49:14 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: There is a null-ptr-deref bug in kvm_dirty_ring_get in
 virt/kvm/dirty_ring.c
Content-Language: en-US
To:     "Woodhouse, David" <dwmw@amazon.co.uk>,
        "butterflyhuangxx@gmail.com" <butterflyhuangxx@gmail.com>
Cc:     "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
References: <CAFcO6XOmoS7EacN_n6v4Txk7xL7iqRa2gABg3F7E3Naf5uG94g@mail.gmail.com>
 <9eb83cdd-9314-0d1f-0d4b-0cf4432e1e84@redhat.com>
 <4b739ed0ce31e459eb8af9f5b0e2b1516d8e4517.camel@amazon.co.uk>
From:   Paolo Bonzini <pbonzini@redhat.com>
In-Reply-To: <4b739ed0ce31e459eb8af9f5b0e2b1516d8e4517.camel@amazon.co.uk>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 11/17/21 10:46, Woodhouse, David wrote:
>> The remaining
>> option would be just "do not mark the page as dirty if the ring buffer
>> is active".  This is feasible because userspace itself has passed the
>> shared info gfn; but again, it's ugly...
> I think I am coming to quite like that 'remaining option' as long as we
> rephrase it as follows:
> 
>   KVM does not mark the shared_info page as dirty, and userspace is
>   expected to*assume*  that it is dirty at all times. It's used for
>   delivering event channel interrupts and the overhead of marking it
>   dirty each time is just pointless.

For the case of dirty-bitmap, one solution could be to only set a bool 
and actually mark the page dirty lazily, at the time of 
KVM_GET_DIRTY_LOG.  For dirty-ring, I agree that it's easiest if 
userspace just "knows" the page is dirty.

Paolo