From: Christoph Schlameuss schlameuss@linux.ibm.com

mainline inclusion from mainline-v6.11-rc1 commit 7816e58967d0e6cadce05c8540b47ed027dc2499 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5E CVE: CVE-2024-43819

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-----------------------------------------------------------

This change rejects the KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM. This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and would thus result in a null pointer dereference further in. Memory management needs to be performed in userspace and using the ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.

Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2.

Signed-off-by: Christoph Schlameuss schlameuss@linux.ibm.com Fixes: 27e0393f15fc ("KVM: s390: ucontrol: per vcpu address spaces") Reviewed-by: Claudio Imbrenda imbrenda@linux.ibm.com Link: https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com Signed-off-by: Janosch Frank frankja@linux.ibm.com [frankja@linux.ibm.com: commit message spelling fix, subject prefix fix] Message-ID: 20240624095902.29375-1-schlameuss@linux.ibm.com

Conflicts: Documentation/virt/kvm/api.rst [Commit bb58b90b1a8f ("KVM: Introduce KVM_SET_USER_MEMORY_REGION2") introduce the description of KVM_SET_USER_MEMORY_REGION2.] Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- Documentation/virt/kvm/api.rst | 6 ++++++ arch/s390/kvm/kvm-s390.c | 3 +++ 2 files changed, 9 insertions(+)

diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index edc682a94ca4..17811002a8f7 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -1396,6 +1396,12 @@ Instead, an abort (data abort if the cause of the page-table update was a load or a store, instruction abort if it was an instruction fetch) is injected in the guest.

+S390: +^^^^^ + +Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. +Returns -EINVAL if called on a protected VM. + 4.36 KVM_SET_TSS_ADDR ---------------------

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 348d030d2660..c019ff0d8ce6 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5764,6 +5764,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, { gpa_t size;

+ if (kvm_is_ucontrol(kvm)) + return -EINVAL; + /* When we are protected, we should not change the memory slots */ if (kvm_s390_pv_get_handle(kvm)) return -EINVAL;