* [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
@ 2023-05-23 14:05 Christian Borntraeger
2023-05-23 14:12 ` David Hildenbrand
2023-05-23 15:10 ` Claudio Imbrenda
0 siblings, 2 replies; 3+ messages in thread
From: Christian Borntraeger @ 2023-05-23 14:05 UTC (permalink / raw)
To: KVM
Cc: Christian Borntraeger, Janosch Frank, David Hildenbrand,
linux-s390, Thomas Huth, Claudio Imbrenda, Heiko Carstens,
Vasily Gorbik, Alexander Gordeev
We do check for target CPU == -1, but this might change at the time we
are going to use it. Hold the physical target CPU in a local variable to
avoid out-of-bound accesses to the cpu arrays.
Cc: Pierre Morel <pmorel@linux.ibm.com>
Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
arch/s390/kvm/diag.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index 807fa9da1e72..3c65b8258ae6 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
{
struct kvm_vcpu *tcpu;
+ int tcpu_cpu;
int tid;
tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
goto no_yield;
/* target guest VCPU already running */
- if (READ_ONCE(tcpu->cpu) >= 0) {
+ tcpu_cpu = READ_ONCE(tcpu->cpu);
+ if (tcpu_cpu >= 0) {
if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
goto no_yield;
/* target host CPU already running */
- if (!vcpu_is_preempted(tcpu->cpu))
+ if (!vcpu_is_preempted(tcpu_cpu))
goto no_yield;
- smp_yield_cpu(tcpu->cpu);
+ smp_yield_cpu(tcpu_cpu);
VCPU_EVENT(vcpu, 5,
"diag time slice end directed to %d: yield forwarded",
tid);
--
2.40.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
2023-05-23 14:05 [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler Christian Borntraeger
@ 2023-05-23 14:12 ` David Hildenbrand
2023-05-23 15:10 ` Claudio Imbrenda
1 sibling, 0 replies; 3+ messages in thread
From: David Hildenbrand @ 2023-05-23 14:12 UTC (permalink / raw)
To: Christian Borntraeger, KVM
Cc: Janosch Frank, linux-s390, Thomas Huth, Claudio Imbrenda,
Heiko Carstens, Vasily Gorbik, Alexander Gordeev
On 23.05.23 16:05, Christian Borntraeger wrote:
> We do check for target CPU == -1, but this might change at the time we
> are going to use it. Hold the physical target CPU in a local variable to
> avoid out-of-bound accesses to the cpu arrays.
>
> Cc: Pierre Morel <pmorel@linux.ibm.com>
> Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
> Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
> Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
> arch/s390/kvm/diag.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
> index 807fa9da1e72..3c65b8258ae6 100644
> --- a/arch/s390/kvm/diag.c
> +++ b/arch/s390/kvm/diag.c
> @@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
> static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
> {
> struct kvm_vcpu *tcpu;
> + int tcpu_cpu;
> int tid;
>
> tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
> @@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
> goto no_yield;
>
> /* target guest VCPU already running */
> - if (READ_ONCE(tcpu->cpu) >= 0) {
> + tcpu_cpu = READ_ONCE(tcpu->cpu);
> + if (tcpu_cpu >= 0) {
> if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
> goto no_yield;
>
> /* target host CPU already running */
> - if (!vcpu_is_preempted(tcpu->cpu))
> + if (!vcpu_is_preempted(tcpu_cpu))
> goto no_yield;
> - smp_yield_cpu(tcpu->cpu);
> + smp_yield_cpu(tcpu_cpu);
> VCPU_EVENT(vcpu, 5,
> "diag time slice end directed to %d: yield forwarded",
> tid);
Reviewed-by: David Hildenbrand <david@redhat.com>
--
Thanks,
David / dhildenb
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
2023-05-23 14:05 [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler Christian Borntraeger
2023-05-23 14:12 ` David Hildenbrand
@ 2023-05-23 15:10 ` Claudio Imbrenda
1 sibling, 0 replies; 3+ messages in thread
From: Claudio Imbrenda @ 2023-05-23 15:10 UTC (permalink / raw)
To: Christian Borntraeger
Cc: KVM, Janosch Frank, David Hildenbrand, linux-s390, Thomas Huth,
Heiko Carstens, Vasily Gorbik, Alexander Gordeev
On Tue, 23 May 2023 16:05:00 +0200
Christian Borntraeger <borntraeger@linux.ibm.com> wrote:
> We do check for target CPU == -1, but this might change at the time we
> are going to use it. Hold the physical target CPU in a local variable to
> avoid out-of-bound accesses to the cpu arrays.
>
> Cc: Pierre Morel <pmorel@linux.ibm.com>
> Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding")
> Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
> Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
> arch/s390/kvm/diag.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
> index 807fa9da1e72..3c65b8258ae6 100644
> --- a/arch/s390/kvm/diag.c
> +++ b/arch/s390/kvm/diag.c
> @@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void)
> static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
> {
> struct kvm_vcpu *tcpu;
> + int tcpu_cpu;
> int tid;
>
> tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4];
> @@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu)
> goto no_yield;
>
> /* target guest VCPU already running */
> - if (READ_ONCE(tcpu->cpu) >= 0) {
> + tcpu_cpu = READ_ONCE(tcpu->cpu);
> + if (tcpu_cpu >= 0) {
> if (!diag9c_forwarding_hz || diag9c_forwarding_overrun())
> goto no_yield;
>
> /* target host CPU already running */
> - if (!vcpu_is_preempted(tcpu->cpu))
> + if (!vcpu_is_preempted(tcpu_cpu))
> goto no_yield;
> - smp_yield_cpu(tcpu->cpu);
> + smp_yield_cpu(tcpu_cpu);
> VCPU_EVENT(vcpu, 5,
> "diag time slice end directed to %d: yield forwarded",
> tid);
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-05-23 15:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-23 14:05 [PATCH] KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler Christian Borntraeger
2023-05-23 14:12 ` David Hildenbrand
2023-05-23 15:10 ` Claudio Imbrenda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox