On Wed, 23 Oct 2019, Yang Shi wrote:
On 10/23/19 12:28 PM, Hugh Dickins wrote:The mmu_notifier_invalidate_range_start.._end() in __split_huge_pmd(),
I was thinking about this too. I'm wondering there might be a case that the+ return map_count >= 0 &&You have added a map_count >= 0 test there. Okay, not wrong, but not
necessary, and not consistent with what's returned in the PageAnon
case (if this were called for an unmapped page).
PMD is split and it was the last PMD map, in this case subpage's _mapcount is
also equal to compound_mapcount (both is -1). So, it would return true, then
KVM may setup PMD map in EPT, but it might be PTE mapped later on the host.
But, I'm not quite sure if this is really possible or if this is really a
integrity problem. So, I thought it might be safer to add this check.
with KVM's locking and sequence counting, is required to protect
against such races.
Hugh