KVM: s390: ucontrol: Fix sca_clear_ext_call()

When cleaning up a UCONTROL VM, sca_clear_ext_call() will touch memory
outside of the allocated ESCA block, and UCONTROL VMs don't even use
ESCA.

Fix by not touching ESCA for UCONTROL VMs, and fence the
KVM_S390_INTERRUPT ioctl altogether. Add extra checks in
sca_ext_call_pending() and sca_inject_ext_call() to make sure UCONTROL
VMs won't touch ESCA.

Fencing does not cause regressions with userspace, since UCONTROL VMs
never used KVM_S390_INTERRUPT ioctls.

Fixes: 7d43bafcff17 ("KVM: s390: Make provisions for ESCA utilization")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260803124040.126471-6-imbrenda@linux.ibm.com>

diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index bb4e7246604387b92f752a16d67f75cc2326d8fe..8f24bcd1a6d36000e0848a2b6b03bd60abbe8980 100644 (file)
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -45,13 +45,16 @@ static struct kvm_s390_gib *gib;
 static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id)
 {
        struct esca_block *sca = vcpu->kvm->arch.sca;
-       union esca_sigp_ctrl sigp_ctrl = sca->cpu[vcpu->vcpu_id].sigp_ctrl;
+       union esca_sigp_ctrl sigp_ctrl;
 
        if (!kvm_s390_test_cpuflags(vcpu, CPUSTAT_ECALL_PEND))
                return 0;
+       if (kvm_is_ucontrol(vcpu->kvm))
+               return 0;
 
        BUG_ON(!kvm_s390_use_sca_entries());
 
+       sigp_ctrl = sca->cpu[vcpu->vcpu_id].sigp_ctrl;
        if (src_id)
                *src_id = sigp_ctrl.scn;
 
@@ -60,13 +63,16 @@ static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id)
 
 static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id)
 {
-       struct esca_block *sca = vcpu->kvm->arch.sca;
-       union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
        union esca_sigp_ctrl old_val, new_val = {.scn = src_id, .c = 1};
+       struct esca_block *sca = vcpu->kvm->arch.sca;
+       union esca_sigp_ctrl *sigp_ctrl;
        int expect, rc;
 
        BUG_ON(!kvm_s390_use_sca_entries());
+       if (kvm_is_ucontrol(vcpu->kvm))
+               return -EINVAL;
 
+       sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
        old_val = READ_ONCE(*sigp_ctrl);
        old_val.c = 0;
 
@@ -84,10 +90,13 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id)
 static void sca_clear_ext_call(struct kvm_vcpu *vcpu)
 {
        struct esca_block *sca = vcpu->kvm->arch.sca;
-       union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
+       union esca_sigp_ctrl *sigp_ctrl;
 
-       if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized)
+       if (!kvm_s390_use_sca_entries() || !vcpu->arch.initialized || kvm_is_ucontrol(vcpu->kvm))
                return;
+
+       /* Initialize after the above check, to prevent going out of bounds */
+       sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
        kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND);
 
        WRITE_ONCE(sigp_ctrl->value, 0);

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 5b2727d7dfd12c967afcfb0bd561579ddb5f5298..21574f57be72e99e36ca75fb1d82eaeeaecd4f65 100644 (file)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2934,6 +2934,9 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
        case KVM_S390_INTERRUPT: {
                struct kvm_s390_interrupt s390int;
 
+               r = -EINVAL;
+               if (kvm_is_ucontrol(kvm))
+                       break;
                r = -EFAULT;
                if (copy_from_user(&s390int, argp, sizeof(s390int)))
                        break;
@@ -5456,6 +5459,8 @@ long kvm_arch_vcpu_unlocked_ioctl(struct file *filp, unsigned int ioctl,
                struct kvm_s390_interrupt s390int;
                struct kvm_s390_irq s390irq = {};
 
+               if (kvm_is_ucontrol(vcpu->kvm))
+                       return -EINVAL;
                if (copy_from_user(&s390int, argp, sizeof(s390int)))
                        return -EFAULT;
                if (s390int_to_s390irq(&s390int, &s390irq))