* [PATCH v1 1/1] KVM: s390: Fix gmap_helper_zap_one_page() again
@ 2025-11-06 15:25 Claudio Imbrenda
2025-11-10 15:38 ` Marc Hartmayer
0 siblings, 1 reply; 2+ messages in thread
From: Claudio Imbrenda @ 2025-11-06 15:25 UTC (permalink / raw)
To: linux-kernel, kvm
Cc: linux-s390, borntraeger, frankja, mhartmay, nrb, nsg, seiden, gra,
schlameuss, hca, svens, agordeev, gor, ggala, david
A few checks were missing in gmap_helper_zap_one_page(), which can lead
to memory corruption in the guest under specific circumstances.
Add the missing checks.
Fixes: 5deafa27d9ae ("KVM: s390: Fix to clear PTE when discarding a swapped page")
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
---
arch/s390/mm/gmap_helpers.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/s390/mm/gmap_helpers.c b/arch/s390/mm/gmap_helpers.c
index d4c3c36855e2..38a2d82cd88a 100644
--- a/arch/s390/mm/gmap_helpers.c
+++ b/arch/s390/mm/gmap_helpers.c
@@ -47,6 +47,7 @@ static void ptep_zap_swap_entry(struct mm_struct *mm, swp_entry_t entry)
void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
{
struct vm_area_struct *vma;
+ unsigned long pgstev;
spinlock_t *ptl;
pgste_t pgste;
pte_t *ptep;
@@ -65,9 +66,13 @@ void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
if (pte_swap(*ptep)) {
preempt_disable();
pgste = pgste_get_lock(ptep);
+ pgstev = pgste_val(pgste);
- ptep_zap_swap_entry(mm, pte_to_swp_entry(*ptep));
- pte_clear(mm, vmaddr, ptep);
+ if ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED ||
+ (pgstev & _PGSTE_GPS_ZERO)) {
+ ptep_zap_swap_entry(mm, pte_to_swp_entry(*ptep));
+ pte_clear(mm, vmaddr, ptep);
+ }
pgste_set_unlock(ptep, pgste);
preempt_enable();
--
2.51.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v1 1/1] KVM: s390: Fix gmap_helper_zap_one_page() again
2025-11-06 15:25 [PATCH v1 1/1] KVM: s390: Fix gmap_helper_zap_one_page() again Claudio Imbrenda
@ 2025-11-10 15:38 ` Marc Hartmayer
0 siblings, 0 replies; 2+ messages in thread
From: Marc Hartmayer @ 2025-11-10 15:38 UTC (permalink / raw)
To: Claudio Imbrenda, linux-kernel, kvm
Cc: linux-s390, borntraeger, frankja, nrb, nsg, seiden, gra,
schlameuss, hca, svens, agordeev, gor, ggala, david
On Thu, Nov 06, 2025 at 04:25 PM +0100, Claudio Imbrenda <imbrenda@linux.ibm.com> wrote:
> A few checks were missing in gmap_helper_zap_one_page(), which can lead
> to memory corruption in the guest under specific circumstances.
>
> Add the missing checks.
>
> Fixes: 5deafa27d9ae ("KVM: s390: Fix to clear PTE when discarding a swapped page")
> Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> ---
> arch/s390/mm/gmap_helpers.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/arch/s390/mm/gmap_helpers.c b/arch/s390/mm/gmap_helpers.c
> index d4c3c36855e2..38a2d82cd88a 100644
> --- a/arch/s390/mm/gmap_helpers.c
> +++ b/arch/s390/mm/gmap_helpers.c
> @@ -47,6 +47,7 @@ static void ptep_zap_swap_entry(struct mm_struct *mm, swp_entry_t entry)
> void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
> {
> struct vm_area_struct *vma;
> + unsigned long pgstev;
> spinlock_t *ptl;
> pgste_t pgste;
> pte_t *ptep;
> @@ -65,9 +66,13 @@ void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
> if (pte_swap(*ptep)) {
> preempt_disable();
> pgste = pgste_get_lock(ptep);
> + pgstev = pgste_val(pgste);
>
> - ptep_zap_swap_entry(mm, pte_to_swp_entry(*ptep));
> - pte_clear(mm, vmaddr, ptep);
> + if ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED ||
> + (pgstev & _PGSTE_GPS_ZERO)) {
> + ptep_zap_swap_entry(mm, pte_to_swp_entry(*ptep));
> + pte_clear(mm, vmaddr, ptep);
> + }
>
> pgste_set_unlock(ptep, pgste);
> preempt_enable();
> --
> 2.51.1
Thanks for the fix.
Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-10 15:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-06 15:25 [PATCH v1 1/1] KVM: s390: Fix gmap_helper_zap_one_page() again Claudio Imbrenda
2025-11-10 15:38 ` Marc Hartmayer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).