Description of problem:

We need write protect memory after the slot swap in kvm_vm_ioctl_get_dirty_log() otherwise we may miss dirty pages.

This issue have been fixed in upstream in:

    KVM: Write protect memory after slot swap
    
    I have observed the following bug trigger:
    
    1. userspace calls GET_DIRTY_LOG
    2. kvm_mmu_slot_remove_write_access is called and makes a page ro
    3. page fault happens and makes the page writeable
       fault is logged in the bitmap appropriately
    4. kvm_vm_ioctl_get_dirty_log swaps slot pointers
    
    a lot of time passes
    
    5. guest writes into the page
    6. userspace calls GET_DIRTY_LOG
    
    At point (5), bitmap is clean and page is writeable,
    thus, guest modification of memory is not logged
    and GET_DIRTY_LOG returns an empty bitmap.
    
    The rule is that all pages are either dirty in the current bitmap,
    or write-protected, which is violated here.
    
    It seems that just moving kvm_mmu_slot_remove_write_access down
    to after the slot pointer swap should fix this bug.
    
    KVM-Stable-Tag.
    Signed-off-by: Michael S. Tsirkin <mst>
    Signed-off-by: Avi Kivity <avi>


Version-Release number of selected component (if applicable):
6.0

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: