[SRU][F/J][PATCH 0/1] CVE-2023-52639

[Ian Whitfield]

[Impact]

Right now it is possible to see gmap->private being zero in
kvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the
fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
                               struct vsie_page *vsie_page)
{
[...]
        gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
        if (IS_ERR(gmap))
                return PTR_ERR(gmap);
        gmap->private = vcpu->kvm;

Let children inherit the private field of the parent.

[Backport]

The patch required an update to its context.

[Fix]

Noble:  not affected
Jammy:  backport
Focal:  backport
Bionic: fix sent to esm mailing list
Xenial: not affected
Trusty: not affected

[Test Case]

Compile and boot tested

[Where problems could occur]

This fix affects those who use KVM virtualization on s390x processors.
An issue with this fix would be visible to user via a system crash.


Christian Borntraeger (1):
  KVM: s390: vsie: fix race during shadow creation

 arch/s390/kvm/vsie.c | 1 -
 arch/s390/mm/gmap.c  | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.0