diff for duplicates of <1471513641199227@kroah.com> diff --git a/a/content_digest b/N1/content_digest index 329c140..16f196e 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -10,8 +10,7 @@ ralf@linux-mips.org rkrcmar@redhat.com " stable@vger.kernel.org\0" - "Cc\0<stable@vger.kernel.org>" - " <stable-commits@vger.kernel.org>\0" + "Cc\0stable-commits@vger.kernel.org\0" "\00:1\0" "b\0" "\n" @@ -29,4 +28,4 @@ "If you, or anyone else, feels it should not be added to the stable tree,\n" please let <stable@vger.kernel.org> know about it. -4409f12f545c2c12be618067bd336a805848fd35b7e7311fbc37cca5a60e61c7 +198136d87ffccea51612ccd871e39822e23a97fb11107ebbd062946424ba6337
diff --git a/a/1.txt b/N2/1.txt index 9e47919..5a13669 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -12,3 +12,89 @@ and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. + + +>From james.hogan@imgtec.com Thu Aug 18 11:44:38 2016 +From: James Hogan <james.hogan@imgtec.com> +Date: Thu, 18 Aug 2016 10:05:30 +0100 +Subject: [PATCH BACKPORT 3.17-4.4 2/4] MIPS: KVM: Add missing gfn range check +To: <stable@vger.kernel.org> +Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Krčmář <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org> +Message-ID: <5ae3371dc11534460b722864ea8c6ef27e8506d1.1471018436.git-series.james.hogan@imgtec.com> + +From: James Hogan <james.hogan@imgtec.com> + +commit 8985d50382359e5bf118fdbefc859d0dbf6cebc7 upstream. + +kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number +based on the guest TLB EntryLo values, however it is not range checked +to ensure it lies within the guest_pmap. If the physical memory the +guest refers to is out of range then dump the guest TLB and emit an +internal error. + +Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.") +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Cc: Paolo Bonzini <pbonzini@redhat.com> +Cc: "Radim Krčmář" <rkrcmar@redhat.com> +Cc: Ralf Baechle <ralf@linux-mips.org> +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> +[james.hogan@imgtec.com: Backport to v3.17.y - v4.4.y] +Signed-off-by: James Hogan <james.hogan@imgtec.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/mips/kvm/tlb.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +--- a/arch/mips/kvm/tlb.c ++++ b/arch/mips/kvm/tlb.c +@@ -361,6 +361,7 @@ int kvm_mips_handle_mapped_seg_tlb_fault + unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; + struct kvm *kvm = vcpu->kvm; + pfn_t pfn0, pfn1; ++ gfn_t gfn0, gfn1; + long tlb_lo[2]; + + tlb_lo[0] = tlb->tlb_lo0; +@@ -374,18 +375,24 @@ int kvm_mips_handle_mapped_seg_tlb_fault + VPN2_MASK & (PAGE_MASK << 1))) + tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; + +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) +- >> PAGE_SHIFT) < 0) ++ gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT; ++ gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT; ++ if (gfn0 >= kvm->arch.guest_pmap_npages || ++ gfn1 >= kvm->arch.guest_pmap_npages) { ++ kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n", ++ __func__, gfn0, gfn1, tlb->tlb_hi); ++ kvm_mips_dump_guest_tlbs(vcpu); + return -1; ++ } + +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) +- >> PAGE_SHIFT) < 0) ++ if (kvm_mips_map_page(kvm, gfn0) < 0) + return -1; + +- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) +- >> PAGE_SHIFT]; +- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) +- >> PAGE_SHIFT]; ++ if (kvm_mips_map_page(kvm, gfn1) < 0) ++ return -1; ++ ++ pfn0 = kvm->arch.guest_pmap[gfn0]; ++ pfn1 = kvm->arch.guest_pmap[gfn1]; + + if (hpa0) + *hpa0 = pfn0 << PAGE_SHIFT; + + +Patches currently in stable-queue which might be from james.hogan@imgtec.com are + +queue-4.4/mips-kvm-add-missing-gfn-range-check.patch +queue-4.4/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch +queue-4.4/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch +queue-4.4/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch diff --git a/a/content_digest b/N2/content_digest index 329c140..7542b59 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -27,6 +27,92 @@ "and it can be found in the queue-4.4 subdirectory.\n" "\n" "If you, or anyone else, feels it should not be added to the stable tree,\n" - please let <stable@vger.kernel.org> know about it. + "please let <stable@vger.kernel.org> know about it.\n" + "\n" + "\n" + ">From james.hogan@imgtec.com Thu Aug 18 11:44:38 2016\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "Date: Thu, 18 Aug 2016 10:05:30 +0100\n" + "Subject: [PATCH BACKPORT 3.17-4.4 2/4] MIPS: KVM: Add missing gfn range check\n" + "To: <stable@vger.kernel.org>\n" + "Cc: James Hogan <james.hogan@imgtec.com>, Paolo Bonzini <pbonzini@redhat.com>, Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>, Ralf Baechle <ralf@linux-mips.org>, <linux-mips@linux-mips.org>, <kvm@vger.kernel.org>\n" + "Message-ID: <5ae3371dc11534460b722864ea8c6ef27e8506d1.1471018436.git-series.james.hogan@imgtec.com>\n" + "\n" + "From: James Hogan <james.hogan@imgtec.com>\n" + "\n" + "commit 8985d50382359e5bf118fdbefc859d0dbf6cebc7 upstream.\n" + "\n" + "kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number\n" + "based on the guest TLB EntryLo values, however it is not range checked\n" + "to ensure it lies within the guest_pmap. If the physical memory the\n" + "guest refers to is out of range then dump the guest TLB and emit an\n" + "internal error.\n" + "\n" + "Fixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Cc: Paolo Bonzini <pbonzini@redhat.com>\n" + "Cc: \"Radim Kr\304\215m\303\241\305\231\" <rkrcmar@redhat.com>\n" + "Cc: Ralf Baechle <ralf@linux-mips.org>\n" + "Cc: linux-mips@linux-mips.org\n" + "Cc: kvm@vger.kernel.org\n" + "Signed-off-by: Radim Kr\304\215m\303\241\305\231 <rkrcmar@redhat.com>\n" + "[james.hogan@imgtec.com: Backport to v3.17.y - v4.4.y]\n" + "Signed-off-by: James Hogan <james.hogan@imgtec.com>\n" + "Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" + "---\n" + " arch/mips/kvm/tlb.c | 23 +++++++++++++++--------\n" + " 1 file changed, 15 insertions(+), 8 deletions(-)\n" + "\n" + "--- a/arch/mips/kvm/tlb.c\n" + "+++ b/arch/mips/kvm/tlb.c\n" + "@@ -361,6 +361,7 @@ int kvm_mips_handle_mapped_seg_tlb_fault\n" + " \tunsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;\n" + " \tstruct kvm *kvm = vcpu->kvm;\n" + " \tpfn_t pfn0, pfn1;\n" + "+\tgfn_t gfn0, gfn1;\n" + " \tlong tlb_lo[2];\n" + " \n" + " \ttlb_lo[0] = tlb->tlb_lo0;\n" + "@@ -374,18 +375,24 @@ int kvm_mips_handle_mapped_seg_tlb_fault\n" + " \t\t\tVPN2_MASK & (PAGE_MASK << 1)))\n" + " \t\ttlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;\n" + " \n" + "-\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0])\n" + "-\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "+\tgfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;\n" + "+\tgfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;\n" + "+\tif (gfn0 >= kvm->arch.guest_pmap_npages ||\n" + "+\t gfn1 >= kvm->arch.guest_pmap_npages) {\n" + "+\t\tkvm_err(\"%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\\n\",\n" + "+\t\t\t__func__, gfn0, gfn1, tlb->tlb_hi);\n" + "+\t\tkvm_mips_dump_guest_tlbs(vcpu);\n" + " \t\treturn -1;\n" + "+\t}\n" + " \n" + "-\tif (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1])\n" + "-\t\t\t\t >> PAGE_SHIFT) < 0)\n" + "+\tif (kvm_mips_map_page(kvm, gfn0) < 0)\n" + " \t\treturn -1;\n" + " \n" + "-\tpfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0])\n" + "-\t\t\t\t >> PAGE_SHIFT];\n" + "-\tpfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1])\n" + "-\t\t\t\t >> PAGE_SHIFT];\n" + "+\tif (kvm_mips_map_page(kvm, gfn1) < 0)\n" + "+\t\treturn -1;\n" + "+\n" + "+\tpfn0 = kvm->arch.guest_pmap[gfn0];\n" + "+\tpfn1 = kvm->arch.guest_pmap[gfn1];\n" + " \n" + " \tif (hpa0)\n" + " \t\t*hpa0 = pfn0 << PAGE_SHIFT;\n" + "\n" + "\n" + "Patches currently in stable-queue which might be from james.hogan@imgtec.com are\n" + "\n" + "queue-4.4/mips-kvm-add-missing-gfn-range-check.patch\n" + "queue-4.4/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch\n" + "queue-4.4/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch\n" + queue-4.4/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch -4409f12f545c2c12be618067bd336a805848fd35b7e7311fbc37cca5a60e61c7 +8bcbeb6985eaf3e42910bdf3560a8f1fcb8fa25faba804bfc40de6d3cd7dbc82
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.