Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5c2c393 authored by David Hildenbrand's avatar David Hildenbrand Committed by Christian Borntraeger
Browse files

KVM: s390: SCA must not cross page boundaries 



We seemed to have missed a few corner cases in commit f6c137ff
("KVM: s390: randomize sca address").

The SCA has a maximum size of 2112 bytes. By setting the sca_offset to
some unlucky numbers, we exceed the page.

0x7c0 (1984) -> Fits exactly
0x7d0 (2000) -> 16 bytes out
0x7e0 (2016) -> 32 bytes out
0x7f0 (2032) -> 48 bytes out

One VCPU entry is 32 bytes long.

For the last two cases, we actually write data to the other page.
1. The address of the VCPU.
2. Injection/delivery/clearing of SIGP externall calls via SIGP IF.

Especially the 2. happens regularly. So this could produce two problems:
1. The guest losing/getting external calls.
2. Random memory overwrites in the host.

So this problem happens on every 127 + 128 created VM with 64 VCPUs.

Cc: stable@vger.kernel.org # v3.15+
Acked-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: default avatarDavid Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
parent 60417fcc

arch/s390/kvm/kvm-s390.c

+3 −1
Original line number Diff line number Diff line
@@ -1098,7 +1098,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) 
	if (!kvm->arch.sca)

		goto out_err;

	spin_lock(&kvm_lock);

	sca_offset = (sca_offset + 16) & 0x7f0;

	sca_offset += 16;

	if (sca_offset + sizeof(struct sca_block) > PAGE_SIZE)

		sca_offset = 0;

	kvm->arch.sca = (struct sca_block *) ((char *) kvm->arch.sca + sca_offset);

	spin_unlock(&kvm_lock);