From mboxrd@z Thu Jan 1 00:00:00 1970 From: ehrhardt@linux.vnet.ibm.com Subject: [PATCH 4/6] kvm-s390: Unlink vcpu on destroy Date: Tue, 5 May 2009 16:39:16 +0200 Message-ID: <1241534358-32172-5-git-send-email-ehrhardt@linux.vnet.ibm.com> References: <1241534358-32172-1-git-send-email-ehrhardt@linux.vnet.ibm.com> Cc: ehrhardt@linux.vnet.ibm.com, Christian Borntraeger , Carsten Otte To: Avi Kivity , kvm@vger.kernel.org Return-path: Received: from mtagate7.uk.ibm.com ([195.212.29.140]:40745 "EHLO mtagate7.uk.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751981AbZEEOjs (ORCPT ); Tue, 5 May 2009 10:39:48 -0400 Received: from d06nrmr1407.portsmouth.uk.ibm.com (d06nrmr1407.portsmouth.uk.ibm.com [9.149.38.185]) by mtagate7.uk.ibm.com (8.14.3/8.13.8) with ESMTP id n45EdLRu377198 for ; Tue, 5 May 2009 14:39:21 GMT Received: from d06av01.portsmouth.uk.ibm.com (d06av01.portsmouth.uk.ibm.com [9.149.37.212]) by d06nrmr1407.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v9.2) with ESMTP id n45EdLgf2773050 for ; Tue, 5 May 2009 15:39:21 +0100 Received: from d06av01.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av01.portsmouth.uk.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id n45EdKFE018983 for ; Tue, 5 May 2009 15:39:21 +0100 In-Reply-To: <1241534358-32172-1-git-send-email-ehrhardt@linux.vnet.ibm.com> Sender: kvm-owner@vger.kernel.org List-ID: From: Carsten Otte This patch makes sure we do unlink a vcpu's sie control block from the system control area in kvm_arch_vcpu_destroy. This prevents illegal accesses to the sie control block from other virtual cpus after free. Reported-by: Mijo Safradin Signed-off-by: Carsten Otte --- arch/s390/kvm/kvm-s390.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) Index: kvm/arch/s390/kvm/kvm-s390.c =================================================================== --- kvm.orig/arch/s390/kvm/kvm-s390.c +++ kvm/arch/s390/kvm/kvm-s390.c @@ -195,6 +195,9 @@ out_nokvm: void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) { VCPU_EVENT(vcpu, 3, "%s", "free cpu"); + if (vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda == + (__u64) vcpu->arch.sie_block) + vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda = 0; free_page((unsigned long)(vcpu->arch.sie_block)); kvm_vcpu_uninit(vcpu); kfree(vcpu); @@ -307,8 +310,10 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st vcpu->arch.sie_block->icpua = id; BUG_ON(!kvm->arch.sca); - BUG_ON(kvm->arch.sca->cpu[id].sda); - kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block; + if (!kvm->arch.sca->cpu[id].sda) + kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block; + else + BUG_ON(!kvm->vcpus[id]); /* vcpu does already exist */ vcpu->arch.sie_block->scaoh = (__u32)(((__u64)kvm->arch.sca) >> 32); vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;