Patch "[PATCH BACKPORT 3.10-3.15 2/4] MIPS: KVM: Add missing gfn range check" has been added to the 3.14-stable tree

Commit Message

Greg Kroah-Hartman Aug. 18, 2016, 9:47 a.m. UTC

This is a note to let you know that I've just added the patch titled

    [PATCH BACKPORT 3.10-3.15 2/4] MIPS: KVM: Add missing gfn range check

to the 3.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mips-kvm-add-missing-gfn-range-check.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <[e-mail]> know about it.


From [e-mail]  Thu Aug 18 11:46:20 2016
From: James Hogan <[e-mail]>
Date: Thu, 18 Aug 2016 10:22:53 +0100
Subject: [PATCH BACKPORT 3.10-3.15 2/4] MIPS: KVM: Add missing gfn range check
To: <[e-mail]>
Cc: James Hogan <[e-mail]>, Paolo Bonzini <[e-mail]>, Radim Krčmář <[e-mail]>, Ralf Baechle <[e-mail]>, <[e-mail]>, <[e-mail]>
Message-ID: <54b01d37d3[e-mail]>

From: James Hogan <[e-mail]>

commit 8985d50382359e5bf118fdbefc859d0dbf6cebc7 upstream.

kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number
based on the guest TLB EntryLo values, however it is not range checked
to ensure it lies within the guest_pmap. If the physical memory the
guest refers to is out of range then dump the guest TLB and emit an
internal error.

Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.")
Signed-off-by: James Hogan <[e-mail]>
Cc: Paolo Bonzini <[e-mail]>
Cc: "Radim Krčmář" <[e-mail]>
Cc: Ralf Baechle <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Signed-off-by: Radim Krčmář <[e-mail]>
[[e-mail]: Backport to v3.10.y - v3.15.y]
Signed-off-by: James Hogan <[e-mail]>
Signed-off-by: Greg Kroah-Hartman <[e-mail]>
---
 arch/mips/kvm/kvm_tlb.c |   19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)



Patches currently in stable-queue which might be from [e-mail] are

queue-3.14/mips-kvm-add-missing-gfn-range-check.patch
queue-3.14/mips-kvm-propagate-kseg0-mapped-tlb-fault-errors.patch
queue-3.14/mips-kvm-fix-mapped-fault-broken-commpage-handling.patch
queue-3.14/mips-kvm-fix-gfn-range-check-in-kseg0-tlb-faults.patch
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

--- a/arch/mips/kvm/kvm_tlb.c
+++ b/arch/mips/kvm/kvm_tlb.c
@@ -370,6 +370,7 @@  kvm_mips_handle_mapped_seg_tlb_fault(str
 	unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
 	struct kvm *kvm = vcpu->kvm;
 	pfn_t pfn0, pfn1;
+	gfn_t gfn0, gfn1;
 	long tlb_lo[2];
 
 	tlb_lo[0] = tlb->tlb_lo0;
@@ -383,14 +384,24 @@  kvm_mips_handle_mapped_seg_tlb_fault(str
 			VPN2_MASK & (PAGE_MASK << 1)))
 		tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
 
-	if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT) < 0)
+	gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;
+	gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;
+	if (gfn0 >= kvm->arch.guest_pmap_npages ||
+	    gfn1 >= kvm->arch.guest_pmap_npages) {
+		kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n",
+			__func__, gfn0, gfn1, tlb->tlb_hi);
+		kvm_mips_dump_guest_tlbs(vcpu);
 		return -1;
+	}
 
-	if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT) < 0)
+	if (kvm_mips_map_page(kvm, gfn0) < 0)
 		return -1;
 
-	pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT];
-	pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT];
+	if (kvm_mips_map_page(kvm, gfn1) < 0)
+		return -1;
+
+	pfn0 = kvm->arch.guest_pmap[gfn0];
+	pfn1 = kvm->arch.guest_pmap[gfn1];
 
 	if (hpa0)
 		*hpa0 = pfn0 << PAGE_SHIFT;