Skip to contentSkip to conversation

Fix prefix register checking in arch/s390/kvm/sigp.c

PATCH Applied Carsten Otte 2 participants 2 messages Nov 30, 2009 – Dec 2, 2009

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

This patch corrects the checking of the new address for the prefix register. On s390, the prefix register is used to address the cpu's lowcore (address 0...8k). This check is supposed to verify that the memory is readable and present.
copy_from_guest is a helper function, that can be used to read from guest memory. It applies prefixing, adds the start address of the guest memory in user, and then calls copy_from_user. Previous code was obviously broken for two reasons:
- prefixing should not be applied here. The current prefix register is going to be updated soon, and the address we're looking for will be 0..8k after we've updated the register
- we're adding the guest origin (gmsor) twice: once in subject code and once in copy_from_guest

With kuli, we did not hit this problem because (a) we were lucky with previous prefix register content, and (b) our guest memory was mmaped very low into user address space.

This patch should go into 2.6.32, it prevents running smp guests with qemu.

---
 sigp.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kvm/sigp.c +3 -3
Index: kvm/arch/s390/kvm/sigp.c
===================================================================
@@ -188,9 +188,9 @@
 
 	/* make sure that the new value is valid memory */
 	address = address & 0x7fffe000u;
-	if ((copy_from_guest(vcpu, &tmp,
-		(u64) (address + vcpu->arch.sie_block->gmsor) , 1)) ||
-	   (copy_from_guest(vcpu, &tmp, (u64) (address +
+	if ((copy_from_user(&tmp, (void __user *)
+		(address + vcpu->arch.sie_block->gmsor) , 1)) ||
+	   (copy_from_user(&tmp, (void __user *)(address +
 			vcpu->arch.sie_block->gmsor + PAGE_SIZE), 1))) {
 		*reg |= SIGP_STAT_INVALID_PARAMETER;
 		return 1; /* invalid parameter */
Applied
#1 lore raw
Quoted 14 lines · Carsten Otte

This patch corrects the checking of the new address for the prefix register. On s390, the prefix register is used to address the cpu's lowcore (address 0...8k). This check is supposed to verify that the memory is readable and present.
copy_from_guest is a helper function, that can be used to read from guest memory. It applies prefixing, adds the start address of the guest memory in user, and then calls copy_from_user. Previous code was obviously broken for two reasons:
- prefixing should not be applied here. The current prefix register is going to be updated soon, and the address we're looking for will be 0..8k after we've updated the register
- we're adding the guest origin (gmsor) twice: once in subject code and once in copy_from_guest

Quoted 5 lines

With kuli, we did not hit this problem because (a) we were lucky with previous prefix register content, and (b) our guest memory was mmaped very low into user address space.

Applied, thanks.

Signature · 1 line
error compiling committee.c: too many arguments to function