Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit abf4a71e authored by Carsten Otte's avatar Carsten Otte Committed by Avi Kivity
Browse files

KVM: s390: Unlink vcpu on destroy - v2 



This patch makes sure we do unlink a vcpu's sie control block
from the system control area in kvm_arch_vcpu_destroy. This
prevents illegal accesses to the sie control block from other
virtual cpus after free.

Reported-by: default avatarMijo Safradin <mijo@linux.vnet.ibm.com>
Signed-off-by: default avatarCarsten Otte <cotte@de.ibm.com>
Signed-off-by: default avatarChristian Ehrhardt <ehrhardt@de.ibm.com>
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent b037a4f3

arch/s390/kvm/kvm-s390.c

+8 −2
Original line number Diff line number Diff line
@@ -196,6 +196,10 @@ struct kvm *kvm_arch_create_vm(void) 
void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)

{

	VCPU_EVENT(vcpu, 3, "%s", "free cpu");

	if (vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda ==

		(__u64) vcpu->arch.sie_block)

		vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda = 0;

	smp_mb();

	free_page((unsigned long)(vcpu->arch.sie_block));

	kvm_vcpu_uninit(vcpu);

	kfree(vcpu);
@@ -310,8 +314,10 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, 


	vcpu->arch.sie_block->icpua = id;

	BUG_ON(!kvm->arch.sca);

	BUG_ON(kvm->arch.sca->cpu[id].sda);

	if (!kvm->arch.sca->cpu[id].sda)

		kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block;

	else

		BUG_ON(!kvm->vcpus[id]); /* vcpu does already exist */

	vcpu->arch.sie_block->scaoh = (__u32)(((__u64)kvm->arch.sca) >> 32);

	vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;