lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 355/575] KVM: s390: pv: avoid double free of sida page
    Date
    From: Claudio Imbrenda <imbrenda@linux.ibm.com>

    [ Upstream commit d4074324b07a94a1fca476d452dfbb3a4e7bf656 ]

    If kvm_s390_pv_destroy_cpu is called more than once, we risk calling
    free_page on a random page, since the sidad field is aliased with the
    gbea, which is not guaranteed to be zero.

    This can happen, for example, if userspace calls the KVM_PV_DISABLE
    IOCTL, and it fails, and then userspace calls the same IOCTL again.
    This scenario is only possible if KVM has some serious bug or if the
    hardware is broken.

    The solution is to simply return successfully immediately if the vCPU
    was already non secure.

    Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
    Fixes: 19e1227768863a1469797c13ef8fea1af7beac2c ("KVM: S390: protvirt: Introduce instruction data area bounce buffer")
    Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
    Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Message-Id: <20210920132502.36111-3-imbrenda@linux.ibm.com>
    Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/s390/kvm/pv.c | 19 +++++++++----------
    1 file changed, 9 insertions(+), 10 deletions(-)

    diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c
    index f5847f9dec7c9..74265304dd9cd 100644
    --- a/arch/s390/kvm/pv.c
    +++ b/arch/s390/kvm/pv.c
    @@ -16,18 +16,17 @@

    int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
    {
    - int cc = 0;
    + int cc;

    - if (kvm_s390_pv_cpu_get_handle(vcpu)) {
    - cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu),
    - UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
    + if (!kvm_s390_pv_cpu_get_handle(vcpu))
    + return 0;
    +
    + cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu), UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
    +
    + KVM_UV_EVENT(vcpu->kvm, 3, "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
    + vcpu->vcpu_id, *rc, *rrc);
    + WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x", *rc, *rrc);

    - KVM_UV_EVENT(vcpu->kvm, 3,
    - "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
    - vcpu->vcpu_id, *rc, *rrc);
    - WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x",
    - *rc, *rrc);
    - }
    /* Intended memory leak for something that should never happen. */
    if (!cc)
    free_pages(vcpu->arch.pv.stor_base,
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 03:03    [W:3.502 / U:0.456 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site