Commit 81917f4d authored by Christoph Schlameuss's avatar Christoph Schlameuss Committed by Li Lingfeng
Browse files

kvm: s390: Reject memory region operations for ucontrol VMs 

mainline inclusion
from mainline-v6.11-rc1
commit 7816e58967d0e6cadce05c8540b47ed027dc2499
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5E
CVE: CVE-2024-43819

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7816e58967d0e6cadce05c8540b47ed027dc2499



-----------------------------------------------------------

This change rejects the KVM_SET_USER_MEMORY_REGION and
KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.
This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and
would thus result in a null pointer dereference further in.
Memory management needs to be performed in userspace and using the
ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.

Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION
and KVM_SET_USER_MEMORY_REGION2.

Signed-off-by: default avatarChristoph Schlameuss <schlameuss@linux.ibm.com>
Fixes: 27e0393f ("KVM: s390: ucontrol: per vcpu address spaces")
Reviewed-by: default avatarClaudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com


Signed-off-by: default avatarJanosch Frank <frankja@linux.ibm.com>
[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix]
Message-ID: <20240624095902.29375-1-schlameuss@linux.ibm.com>

Conflicts:
  arch/s390/kvm/kvm-s390.c
  Documentation/virt/kvm/api.rst
[Commit cf5b4869 ("KVM: s390: Use "new" memslot instead of userspace
memory region") add definition of "size";
Commit b8f8d190 ("KVM: arm64: Document the behaviour of S1PTW faults
on RO memslots") add some descriptions before KVM_SET_TSS_ADDR;
Commit bb58b90b1a8f ("KVM: Introduce KVM_SET_USER_MEMORY_REGION2")
introduce the description of KVM_SET_USER_MEMORY_REGION2.]
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 37fbb7ba

Documentation/virt/kvm/api.rst

+5 −0
Original line number Diff line number Diff line
@@ -1331,6 +1331,11 @@ It is recommended to use this API instead of the KVM_SET_MEMORY_REGION ioctl. 
The KVM_SET_MEMORY_REGION does not allow fine grained control over memory

allocation and is deprecated.



S390:

^^^^^



Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set.

Returns -EINVAL if called on a protected VM.



4.36 KVM_SET_TSS_ADDR

---------------------

arch/s390/kvm/kvm-s390.c

+3 −0
Original line number Diff line number Diff line
@@ -4992,6 +4992,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, 
				   const struct kvm_userspace_memory_region *mem,

				   enum kvm_mr_change change)

{

	if (kvm_is_ucontrol(kvm))

		return -EINVAL;



	/* A few sanity checks. We can have memory slots which have to be

	   located/ended at a segment boundary (1MB). The memory in userland is

	   ok to be fragmented into various different vmas. It is okay to mmap()