KVM: s390: Unlink vcpu on destroy - v2 (abf4a71e) · Commits · 戴 / test

This patch makes sure we do unlink a vcpu's sie control block from the system control area in kvm_arch_vcpu_destroy. This prevents illegal accesses to the sie control block from other virtual cpus after free. Reported-by:

Mijo Safradin <mijo@linux.vnet.ibm.com> Signed-off-by:

Carsten Otte <cotte@de.ibm.com> Signed-off-by:

Christian Ehrhardt <ehrhardt@de.ibm.com> Signed-off-by:

Avi Kivity <avi@redhat.com>

arch/s390/kvm/kvm-s390.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -196,6 +196,10 @@ out_nokvm:
		void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
		{
		VCPU_EVENT(vcpu, 3, "%s", "free cpu");
		if (vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda ==
		(__u64) vcpu->arch.sie_block)
		vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda = 0;
		smp_mb();
		free_page((unsigned long)(vcpu->arch.sie_block));
		kvm_vcpu_uninit(vcpu);
		kfree(vcpu);
		@@ -310,8 +314,10 @@ struct kvm_vcpu kvm_arch_vcpu_create(struct kvm kvm,

		vcpu->arch.sie_block->icpua = id;
		BUG_ON(!kvm->arch.sca);
		BUG_ON(kvm->arch.sca->cpu[id].sda);
		if (!kvm->arch.sca->cpu[id].sda)
		kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block;
		else
		BUG_ON(!kvm->vcpus[id]); /* vcpu does already exist */
		vcpu->arch.sie_block->scaoh = (__u32)(((__u64)kvm->arch.sca) >> 32);
		vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;

Admin message