forked from luck/tmp_suning_uos_patched
KVM: s390: Sanity check on validity intercept
This patch adds a sanity check for the content of the guest prefix register content before faulting in the cpu lowcore that it refers to. The guest might end up in an endless loop where SIE complains about missing lowcore with incorrect content of the prefix register without this fix. Reported-by: Mijo Safradin <mijo@linux.vnet.ibm.com> Signed-off-by: Carsten Otte <cotte@de.ibm.com> Signed-off-by: Christian Ehrhardt <ehrhardt@de.ibm.com> Signed-off-by: Avi Kivity <avi@redhat.com>
This commit is contained in:
parent
abf4a71ed9
commit
3edbcff9bf
@ -154,17 +154,25 @@ static int handle_stop(struct kvm_vcpu *vcpu)
|
||||
static int handle_validity(struct kvm_vcpu *vcpu)
|
||||
{
|
||||
int viwhy = vcpu->arch.sie_block->ipb >> 16;
|
||||
int rc;
|
||||
|
||||
vcpu->stat.exit_validity++;
|
||||
if (viwhy == 0x37) {
|
||||
fault_in_pages_writeable((char __user *)
|
||||
vcpu->kvm->arch.guest_origin +
|
||||
vcpu->arch.sie_block->prefix,
|
||||
PAGE_SIZE);
|
||||
return 0;
|
||||
}
|
||||
VCPU_EVENT(vcpu, 2, "unhandled validity intercept code %d",
|
||||
viwhy);
|
||||
return -ENOTSUPP;
|
||||
if ((viwhy == 0x37) && (vcpu->arch.sie_block->prefix
|
||||
<= vcpu->kvm->arch.guest_memsize - 2*PAGE_SIZE)){
|
||||
rc = fault_in_pages_writeable((char __user *)
|
||||
vcpu->kvm->arch.guest_origin +
|
||||
vcpu->arch.sie_block->prefix,
|
||||
2*PAGE_SIZE);
|
||||
if (rc)
|
||||
/* user will receive sigsegv, exit to user */
|
||||
rc = -ENOTSUPP;
|
||||
} else
|
||||
rc = -ENOTSUPP;
|
||||
|
||||
if (rc)
|
||||
VCPU_EVENT(vcpu, 2, "unhandled validity intercept code %d",
|
||||
viwhy);
|
||||
return rc;
|
||||
}
|
||||
|
||||
static int handle_instruction(struct kvm_vcpu *vcpu)
|
||||
|
Loading…
Reference in New Issue
Block a user