Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

KVM: s390: Reject setting flic pfault attributes on ucontrol VMs

Prevent null pointer dereference when processing the
KVM_DEV_FLIC_APF_ENABLE and KVM_DEV_FLIC_APF_DISABLE_WAIT ioctls in the
interrupt controller.

Fixes: 3c038e6be0e2 ("KVM: async_pf: Async page fault support on s390")
Reported-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Reviewed-by: Hariharan Mari <hari55@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20241216092140.329196-2-schlameuss@linux.ibm.com
Message-ID: <20241216092140.329196-2-schlameuss@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>

authored by

Christoph Schlameuss and committed by
Claudio Imbrenda
df989238 984aaf61

+8
+4
Documentation/virt/kvm/devices/s390_flic.rst
··· 58 58 Enables async page faults for the guest. So in case of a major page fault 59 59 the host is allowed to handle this async and continues the guest. 60 60 61 + -EINVAL is returned when called on the FLIC of a ucontrol VM. 62 + 61 63 KVM_DEV_FLIC_APF_DISABLE_WAIT 62 64 Disables async page faults for the guest and waits until already pending 63 65 async page faults are done. This is necessary to trigger a completion interrupt 64 66 for every init interrupt before migrating the interrupt list. 67 + 68 + -EINVAL is returned when called on the FLIC of a ucontrol VM. 65 69 66 70 KVM_DEV_FLIC_ADAPTER_REGISTER 67 71 Register an I/O adapter interrupt source. Takes a kvm_s390_io_adapter
+4
arch/s390/kvm/interrupt.c
··· 2678 2678 kvm_s390_clear_float_irqs(dev->kvm); 2679 2679 break; 2680 2680 case KVM_DEV_FLIC_APF_ENABLE: 2681 + if (kvm_is_ucontrol(dev->kvm)) 2682 + return -EINVAL; 2681 2683 dev->kvm->arch.gmap->pfault_enabled = 1; 2682 2684 break; 2683 2685 case KVM_DEV_FLIC_APF_DISABLE_WAIT: 2686 + if (kvm_is_ucontrol(dev->kvm)) 2687 + return -EINVAL; 2684 2688 dev->kvm->arch.gmap->pfault_enabled = 0; 2685 2689 /* 2686 2690 * Make sure no async faults are in transition when