git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 13a17cc0526f08d1df9507f7484176371cd263a0 Mon Sep 17 00:00:00 2001
   2 From: Igor Mammedov <imammedo@redhat.com>
   3 Date: Wed, 11 Sep 2019 03:52:18 -0400
   4 Subject: KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset()
   5
   6 From: Igor Mammedov <imammedo@redhat.com>
   7
   8 commit 13a17cc0526f08d1df9507f7484176371cd263a0 upstream.
   9
  10 If userspace doesn't set KVM_MEM_LOG_DIRTY_PAGES on memslot before calling
  11 kvm_s390_vm_start_migration(), kernel will oops with:
  12
  13   Unable to handle kernel pointer dereference in virtual kernel address space
  14   Failing address: 0000000000000000 TEID: 0000000000000483
  15   Fault in home space mode while using kernel ASCE.
  16   AS:0000000002a2000b R2:00000001bff8c00b R3:00000001bff88007 S:00000001bff91000 P:000000000000003d
  17   Oops: 0004 ilc:2 [#1] SMP
  18   ...
  19   Call Trace:
  20   ([<001fffff804ec552>] kvm_s390_vm_set_attr+0x347a/0x3828 [kvm])
  21    [<001fffff804ecfc0>] kvm_arch_vm_ioctl+0x6c0/0x1998 [kvm]
  22    [<001fffff804b67e4>] kvm_vm_ioctl+0x51c/0x11a8 [kvm]
  23    [<00000000008ba572>] do_vfs_ioctl+0x1d2/0xe58
  24    [<00000000008bb284>] ksys_ioctl+0x8c/0xb8
  25    [<00000000008bb2e2>] sys_ioctl+0x32/0x40
  26    [<000000000175552c>] system_call+0x2b8/0x2d8
  27   INFO: lockdep is turned off.
  28   Last Breaking-Event-Address:
  29    [<0000000000dbaf60>] __memset+0xc/0xa0
  30
  31 due to ms->dirty_bitmap being NULL, which might crash the host.
  32
  33 Make sure that ms->dirty_bitmap is set before using it or
  34 return -EINVAL otherwise.
  35
  36 Cc: <stable@vger.kernel.org>
  37 Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots")
  38 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
  39 Link: https://lore.kernel.org/kvm/20190911075218.29153-1-imammedo@redhat.com/
  40 Reviewed-by: David Hildenbrand <david@redhat.com>
  41 Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
  42 Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
  43 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
  44 Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
  45 Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
  46 Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
  47 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  48
  49 ---
  50  arch/s390/kvm/kvm-s390.c |    2 ++
  51  1 file changed, 2 insertions(+)
  52
  53 --- a/arch/s390/kvm/kvm-s390.c
  54 +++ b/arch/s390/kvm/kvm-s390.c
  55 @@ -928,6 +928,8 @@ static int kvm_s390_vm_start_migration(s
  56         /* mark all the pages in active slots as dirty */
  57         for (slotnr = 0; slotnr < slots->used_slots; slotnr++) {
  58                 ms = slots->memslots + slotnr;
  59 +               if (!ms->dirty_bitmap)
  60 +                       return -EINVAL;
  61                 /*
  62                  * The second half of the bitmap is only used on x86,
  63                  * and would be wasted otherwise, so we put it to good