diff for duplicates of <1471513620253162@kroah.com> diff --git a/a/content_digest b/N1/content_digest index 2d3d449..67f510e 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -10,8 +10,7 @@ ralf@linux-mips.org rkrcmar@redhat.com " stable@vger.kernel.org\0" - "Cc\0<stable@vger.kernel.org>" - " <stable-commits@vger.kernel.org>\0" + "Cc\0stable-commits@vger.kernel.org\0" "\00:1\0" "b\0" "\n" @@ -29,4 +28,4 @@ "If you, or anyone else, feels it should not be added to the stable tree,\n" please let <stable@vger.kernel.org> know about it. -fc00003e4783dee1c5386cd3c7d7e906710072b6a91800c9ae7f88216fd83cba +5b3a0667404d63a1cd85204fa54db479f4db22bf2e7be18ec1a5d1fb25ee5e24
diff --git a/a/1.txt b/N2/1.txt index eb781de..9afde6e 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -12,3 +12,85 @@ and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. + + +>From james.hogan@imgtec.com Thu Aug 18 11:46:20 2016 +From: James Hogan <james.hogan@imgtec.com> +Date: Thu, 18 Aug 2016 10:22:53 +0100 +Subject: [PATCH BACKPORT 3.10-3.15 2/4] MIPS: KVM: Add missing gfn range check +To: <stable@vger.kernel.org> +Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Krčmář <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org> +Message-ID: <54b01d37d3ac6ff18fdef80d1189d3c1285d4f46.1471021142.git-series.james.hogan@imgtec.com> + +From: James Hogan <james.hogan@imgtec.com> + +commit 8985d50382359e5bf118fdbefc859d0dbf6cebc7 upstream. + +kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number +based on the guest TLB EntryLo values, however it is not range checked +to ensure it lies within the guest_pmap. If the physical memory the +guest refers to is out of range then dump the guest TLB and emit an +internal error. + +Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.") +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Cc: Paolo Bonzini <pbonzini@redhat.com> +Cc: "Radim Krčmář" <rkrcmar@redhat.com> +Cc: Ralf Baechle <ralf@linux-mips.org> +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> +[james.hogan@imgtec.com: Backport to v3.10.y - v3.15.y] +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/mips/kvm/kvm_tlb.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/arch/mips/kvm/kvm_tlb.c ++++ b/arch/mips/kvm/kvm_tlb.c +@@ -370,6 +370,7 @@ kvm_mips_handle_mapped_seg_tlb_fault(str + unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; + struct kvm *kvm = vcpu->kvm; + pfn_t pfn0, pfn1; ++ gfn_t gfn0, gfn1; + long tlb_lo[2]; + + tlb_lo[0] = tlb->tlb_lo0; +@@ -383,14 +384,24 @@ kvm_mips_handle_mapped_seg_tlb_fault(str + VPN2_MASK & (PAGE_MASK << 1))) + tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; + +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT) < 0) ++ gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT; ++ gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT; ++ if (gfn0 >= kvm->arch.guest_pmap_npages || ++ gfn1 >= kvm->arch.guest_pmap_npages) { ++ kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n", ++ __func__, gfn0, gfn1, tlb->tlb_hi); ++ kvm_mips_dump_guest_tlbs(vcpu); + return -1; ++ } + +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT) < 0) ++ if (kvm_mips_map_page(kvm, gfn0) < 0) + return -1; + +- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT]; +- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT]; ++ if (kvm_mips_map_page(kvm, gfn1) < 0) ++ return -1; ++ ++ pfn0 = kvm->arch.guest_pmap[gfn0]; ++ pfn1 = kvm->arch.guest_pmap[gfn1]; + + if (hpa0) + *hpa0 = pfn0 << PAGE_SHIFT; + + +Patches currently in stable-queue which might be from james.hogan@imgtec.com are + +queue-3.14/mips-kvm-add-missing-gfn-range-check.patch +queue-3.14/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch +queue-3.14/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch +queue-3.14/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch diff --git a/a/content_digest b/N2/content_digest index 2d3d449..59439ef 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -27,6 +27,88 @@ "and it can be found in the queue-3.14 subdirectory.\n" "\n" "If you, or anyone else, feels it should not be added to the stable tree,\n" - please let <stable@vger.kernel.org> know about it. + "please let <stable@vger.kernel.org> know about it.\n" + "\n" + "\n" + ">From james.hogan@imgtec.com Thu Aug 18 11:46:20 2016\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "Date: Thu, 18 Aug 2016 10:22:53 +0100\n" + "Subject: [PATCH BACKPORT 3.10-3.15 2/4] MIPS: KVM: Add missing gfn range check\n" + "To: <stable@vger.kernel.org>\n" + "Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org>\n" + "Message-ID: <54b01d37d3ac6ff18fdef80d1189d3c1285d4f46.1471021142.git-series.james.hogan@imgtec.com>\n" + "\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "\n" + "commit 8985d50382359e5bf118fdbefc859d0dbf6cebc7 upstream.\n" + "\n" + "kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number\n" + "based on the guest TLB EntryLo values, however it is not range checked\n" + "to ensure it lies within the guest_pmap. If the physical memory the\n" + "guest refers to is out of range then dump the guest TLB and emit an\n" + "internal error.\n" + "\n" + "Fixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Cc: Paolo Bonzini <pbonzini@redhat.com>\n" + "Cc: \"Radim Kr\304\215m\303\241\305\231\" <rkrcmar@redhat.com>\n" + "Cc: Ralf Baechle <ralf@linux-mips.org>\n" + "Cc: linux-mips@linux-mips.org\n" + "Cc: kvm@vger.kernel.org\n" + "Signed-off-by: Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>\n" + "[james.hogan@imgtec.com: Backport to v3.10.y - v3.15.y]\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" + "---\n" + " arch/mips/kvm/kvm_tlb.c | 19 +++++++++++++++----\n" + " 1 file changed, 15 insertions(+), 4 deletions(-)\n" + "\n" + "--- a/arch/mips/kvm/kvm_tlb.c\n" + "+++ b/arch/mips/kvm/kvm_tlb.c\n" + "@@ -370,6 +370,7 @@ kvm_mips_handle_mapped_seg_tlb_fault(str\n" + " \tunsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;\n" + " \tstruct kvm *kvm = vcpu->kvm;\n" + " \tpfn_t pfn0, pfn1;\n" + "+\tgfn_t gfn0, gfn1;\n" + " \tlong tlb_lo[2];\n" + " \n" + " \ttlb_lo[0] = tlb->tlb_lo0;\n" + "@@ -383,14 +384,24 @@ kvm_mips_handle_mapped_seg_tlb_fault(str\n" + " \t\t\tVPN2_MASK & (PAGE_MASK << 1)))\n" + " \t\ttlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;\n" + " \n" + "-\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT) < 0)\n" + "+\tgfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;\n" + "+\tgfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;\n" + "+\tif (gfn0 >= kvm->arch.guest_pmap_npages ||\n" + "+\t gfn1 >= kvm->arch.guest_pmap_npages) {\n" + "+\t\tkvm_err(\"%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\\n\",\n" + "+\t\t\t__func__, gfn0, gfn1, tlb->tlb_hi);\n" + "+\t\tkvm_mips_dump_guest_tlbs(vcpu);\n" + " \t\treturn -1;\n" + "+\t}\n" + " \n" + "-\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT) < 0)\n" + "+\tif (kvm_mips_map_page(kvm, gfn0) < 0)\n" + " \t\treturn -1;\n" + " \n" + "-\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT];\n" + "-\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT];\n" + "+\tif (kvm_mips_map_page(kvm, gfn1) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tpfn0 = kvm->arch.guest_pmap[gfn0];\n" + "+\tpfn1 = kvm->arch.guest_pmap[gfn1];\n" + " \n" + " \tif (hpa0)\n" + " \t\t*hpa0 = pfn0 << PAGE_SHIFT;\n" + "\n" + "\n" + "Patches currently in stable-queue which might be from james.hogan@imgtec.com are\n" + "\n" + "queue-3.14/mips-kvm-add-missing-gfn-range-check.patch\n" + "queue-3.14/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch\n" + "queue-3.14/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch\n" + queue-3.14/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch -fc00003e4783dee1c5386cd3c7d7e906710072b6a91800c9ae7f88216fd83cba +0946addf7787c2e6529e91f9181064bb4c8483cc94beb3890a01a243f19a8e76
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.