public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Zelin Deng <zelin.deng@linux.alibaba.com>
To: Thomas Gleixner <tglx@linutronix.de>,
	Paolo Bonzini <pbonzini@redhat.com>
Cc: x86@kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH 2/2] ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm
Date: Wed, 29 Sep 2021 13:13:49 +0800	[thread overview]
Message-ID: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com> (raw)
In-Reply-To: <1632892429-101194-1-git-send-email-zelin.deng@linux.alibaba.com>

If PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPU >= 64, struct
pvclock_vcpu_time_info *src which is got by "src = &hv_clock[cpu].pvti"
could be wild/dangling pointer, as hv_clock arrary has only
HVC_BOOT_ARRAY_SIZE (64) elements.
Therefore let's change it to "this_cpu_pvti()"

Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable")
Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
---
 drivers/ptp/ptp_kvm_x86.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/ptp/ptp_kvm_x86.c b/drivers/ptp/ptp_kvm_x86.c
index 3dd519d..d0096cd 100644
--- a/drivers/ptp/ptp_kvm_x86.c
+++ b/drivers/ptp/ptp_kvm_x86.c
@@ -15,8 +15,6 @@
 #include <linux/ptp_clock_kernel.h>
 #include <linux/ptp_kvm.h>
 
-struct pvclock_vsyscall_time_info *hv_clock;
-
 static phys_addr_t clock_pair_gpa;
 static struct kvm_clock_pairing clock_pair;
 
@@ -28,8 +26,7 @@ int kvm_arch_ptp_init(void)
 		return -ENODEV;
 
 	clock_pair_gpa = slow_virt_to_phys(&clock_pair);
-	hv_clock = pvclock_get_pvti_cpu0_va();
-	if (!hv_clock)
+	if (!pvclock_get_pvti_cpu0_va())
 		return -ENODEV;
 
 	ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa,
@@ -64,10 +61,8 @@ int kvm_arch_ptp_get_crosststamp(u64 *cycle, struct timespec64 *tspec,
 	struct pvclock_vcpu_time_info *src;
 	unsigned int version;
 	long ret;
-	int cpu;
 
-	cpu = smp_processor_id();
-	src = &hv_clock[cpu].pvti;
+	src = this_cpu_pvti();
 
 	do {
 		/*
-- 
1.8.3.1


  parent reply	other threads:[~2021-09-29  5:13 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-29  5:13 [PATCH 0/2] Fix wild/dangling pointer in x86 ptp_kvm Zelin Deng
2021-09-29  5:13 ` [PATCH 1/2] x86/kvmclock: Move this_cpu_pvti into kvmclock.h Zelin Deng
2021-09-29  5:13 ` Zelin Deng [this message]
2021-09-29 12:57 ` [PATCH 0/2] Fix wild/dangling pointer in x86 ptp_kvm Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com \
    --to=zelin.deng@linux.alibaba.com \
    --cc=kvm@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox