KVM: MMU: Fix potential race setting upper shadow ptes on nonpae hosts

Original-Commit-Hash: c23a6fe17abf8562e675465f8d55ba1a551d314d

The direct mapped shadow code (used for real mode and two dimensional paging)
sets upper-level ptes using direct assignment rather than calling
set_shadow_pte().  A nonpae host will split this into two writes, which opens
up a race if another vcpu accesses the same memory area.

Fix by calling set_shadow_pte() instead of assigning directly.

Noticed by Izik Eidus.

Signed-off-by: Avi Kivity <avi@qumranet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index c640b2f96c860874c03694ec922a036a164d7ada..c26d811d9191aa232df87d7b6bee3da49d609492 100644 (file)
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1171,9 +1171,10 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
                                return -ENOMEM;
                        }
 
-                       table[index] = __pa(new_table->spt)
-                               | PT_PRESENT_MASK | PT_WRITABLE_MASK
-                               | shadow_user_mask | shadow_x_mask;
+                       set_shadow_pte(&table[index],
+                                      __pa(new_table->spt)
+                                      | PT_PRESENT_MASK | PT_WRITABLE_MASK
+                                      | shadow_user_mask | shadow_x_mask);
                }
                table_addr = table[index] & PT64_BASE_ADDR_MASK;
        }