[SRU][F][PATCH 1/1] KVM: s390: vsie: fix race during shadow creation
Ian Whitfield
ian.whitfield at canonical.com
Tue Oct 1 22:01:20 UTC 2024
From: Christian Borntraeger <borntraeger at linux.ibm.com>
Right now it is possible to see gmap->private being zero in
kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the
fact that we add gmap->private == kvm after creation:
static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]
gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
if (IS_ERR(gmap))
return PTR_ERR(gmap);
gmap->private = vcpu->kvm;
Let children inherit the private field of the parent.
Reported-by: Marc Hartmayer <mhartmay at linux.ibm.com>
Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc: <stable at vger.kernel.org>
Cc: David Hildenbrand <david at redhat.com>
Reviewed-by: Janosch Frank <frankja at linux.ibm.com>
Reviewed-by: David Hildenbrand <david at redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda at linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger at linux.ibm.com>
Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com
(backported from commit fe752331d4b361d43cfd0b89534b4b2176057c32)
[ijwhitfield: adjusted context due to missing commit
c3235e2dd695 ("KVM: s390: add stat counter for shadow gmap events")]
CVE-2023-52639
Signed-off-by: Ian Whitfield <ian.whitfield at canonical.com>
---
arch/s390/kvm/vsie.c | 1 -
arch/s390/mm/gmap.c | 1 +
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 05db4bad8502..8bcb24e961d2 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1115,7 +1115,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
if (IS_ERR(gmap))
return PTR_ERR(gmap);
- gmap->private = vcpu->kvm;
WRITE_ONCE(vsie_page->gmap, gmap);
return 0;
}
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index dd68b3044b2b..36ff989d3880 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -1670,6 +1670,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce,
return ERR_PTR(-ENOMEM);
new->mm = parent->mm;
new->parent = gmap_get(parent);
+ new->private = parent->private;
new->orig_asce = asce;
new->edat_level = edat_level;
new->initialized = false;
--
2.43.0
More information about the kernel-team
mailing list