Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 16 May 2022 17:55:33 +0200
From:   Claudio Imbrenda <imbrenda@linux.ibm.com>
To:     Nico Boehr <nrb@linux.ibm.com>
Cc:     kvm@vger.kernel.org, borntraeger@de.ibm.com, frankja@linux.ibm.com,
        thuth@redhat.com, pasic@linux.ibm.com, david@redhat.com,
        linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org,
        scgl@linux.ibm.com, mimu@linux.ibm.com
Subject: Re: [PATCH v10 01/19] KVM: s390: pv: leak the topmost page table
 when destroy fails
Message-ID: <20220516175533.4bf3dd93@p-imbrenda>
In-Reply-To: <560068a1e89c2ceec0d544fcc62fa3f95d390182.camel@linux.ibm.com>
References: <20220414080311.1084834-1-imbrenda@linux.ibm.com>
        <20220414080311.1084834-2-imbrenda@linux.ibm.com>
        <560068a1e89c2ceec0d544fcc62fa3f95d390182.camel@linux.ibm.com>
Organization: IBM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, 16 May 2022 09:22:09 +0200
Nico Boehr <nrb@linux.ibm.com> wrote:

> On Thu, 2022-04-14 at 10:02 +0200, Claudio Imbrenda wrote:
>=20
> [...]
> > +/**
> > + * s390_replace_asce - Try to replace the current ASCE of a gmap
> > with
> > + * another equivalent one.
> > + * @gmap the gmap
> > + *
> > + * If the allocation of the new top level page table fails, the ASCE
> > is not
> > + * replaced.
> > + * In any case, the old ASCE is always removed from the list.
> > Therefore the
> > + * caller has to make sure to save a pointer to it beforehands,
> > unless an
> > + * intentional leak is intended.
> > + */
> > +int s390_replace_asce(struct gmap *gmap)
> > +{
> >  =20
> [...]
> > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/* Set new table origin whil=
e preserving existing ASCE
> > control bits */
> > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0asce =3D (gmap->asce & ~_ASC=
E_ORIGIN) | __pa(table);
> > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0WRITE_ONCE(gmap->asce, asce)=
; =20
>=20
> Can someone concurrently touch the control bits?

should not happen, nobody is using the ASCE while we replace it

moreover, all callers of s390_replace_asce hold kvm->lock, as do all
functions changing the ASCE