Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5c6f760 authored by Paul Mackerras's avatar Paul Mackerras
Browse files

KVM: PPC: Book3S HV: Read kvm->arch.emul_smt_mode under kvm->lock 



Commit 1e175d2e ("KVM: PPC: Book3S HV: Pack VCORE IDs to access full
VCPU ID space", 2018-07-25) added code that uses kvm->arch.emul_smt_mode
before any VCPUs are created.  However, userspace can change
kvm->arch.emul_smt_mode at any time up until the first VCPU is created.
Hence it is (theoretically) possible for the check in
kvmppc_core_vcpu_create_hv() to race with another userspace thread
changing kvm->arch.emul_smt_mode.

This fixes it by moving the test that uses kvm->arch.emul_smt_mode into
the block where kvm->lock is held.

Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
parent 1ebe6b81

arch/powerpc/kvm/book3s_hv.c

+8 −9
Original line number Diff line number Diff line
@@ -1989,16 +1989,10 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm, 
						   unsigned int id)

{

	struct kvm_vcpu *vcpu;

	int err = -EINVAL;

	int err;

	int core;

	struct kvmppc_vcore *vcore;



	if (id >= (KVM_MAX_VCPUS * kvm->arch.emul_smt_mode) &&

	    cpu_has_feature(CPU_FTR_ARCH_300)) {

		pr_devel("DNCI: VCPU ID too high\n");

		goto out;

	}



	err = -ENOMEM;

	vcpu = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);

	if (!vcpu)
@@ -2055,8 +2049,13 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm, 
	vcore = NULL;

	err = -EINVAL;

	if (cpu_has_feature(CPU_FTR_ARCH_300)) {

		if (id >= (KVM_MAX_VCPUS * kvm->arch.emul_smt_mode)) {

			pr_devel("KVM: VCPU ID too high\n");

			core = KVM_MAX_VCORES;

		} else {

			BUG_ON(kvm->arch.smt_mode != 1);

			core = kvmppc_pack_vcpu_id(kvm, id);

		}

	} else {

		core = id / kvm->arch.smt_mode;

	}