Commit 0bc380be authored by Christian Borntraeger's avatar Christian Borntraeger Committed by Janosch Frank
Browse files

KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler 



We do check for target CPU == -1, but this might change at the time we
are going to use it. Hold the physical target CPU in a local variable to
avoid out-of-bound accesses to the cpu arrays.

Cc: Pierre Morel <pmorel@linux.ibm.com>
Fixes: 87e28a15 ("KVM: s390: diag9c (directed yield) forwarding")
Reported-by: default avatarMarc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: default avatarNico Boehr <nrb@linux.ibm.com>
Reviewed-by: default avatarPierre Morel <pmorel@linux.ibm.com>
Signed-off-by: default avatarChristian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: default avatarJanosch Frank <frankja@linux.ibm.com>
parent 246be7d2

arch/s390/kvm/diag.c

+5 −3
Original line number Diff line number Diff line
@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void) 
static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)

{

	struct kvm_vcpu *tcpu;

	int tcpu_cpu;

	int tid;



	tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) 
		goto no_yield;



	/* target guest VCPU already running */

	if (READ_ONCE(tcpu->cpu) >= 0) {

	tcpu_cpu = READ_ONCE(tcpu->cpu);

	if (tcpu_cpu >= 0) {

		if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())

			goto no_yield;



		/* target host CPU already running */

		if (!vcpu_is_preempted(tcpu->cpu))

		if (!vcpu_is_preempted(tcpu_cpu))

			goto no_yield;

		smp_yield_cpu(tcpu->cpu);

		smp_yield_cpu(tcpu_cpu);

		VCPU_EVENT(vcpu, 5,

			   "diag time slice end directed to %d: yield forwarded",

			   tid);