diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2023-05-05 13:15:09 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2023-05-05 13:15:09 +0300 |
| commit | 7a8016d95651fecce5708ed93a24a03a9ad91c80 (patch) | |
| tree | 4f06d729d1832bc0e4ce6b0914f7d00a1247a5c2 /arch/s390/mm | |
| parent | 29b38e765016e7b99f6ced75b359ee2b44f17269 (diff) | |
| parent | c148dc8e2fa403be501612ee409db866eeed35c0 (diff) | |
| download | linux-7a8016d95651fecce5708ed93a24a03a9ad91c80.tar.xz | |
Merge tag 'kvm-s390-next-6.4-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD
For 6.4
Diffstat (limited to 'arch/s390/mm')
| -rw-r--r-- | arch/s390/mm/gmap.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 0949811761e6..8492a3f5642e 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -2840,6 +2840,9 @@ EXPORT_SYMBOL_GPL(s390_unlist_old_asce); * s390_replace_asce - Try to replace the current ASCE of a gmap with a copy * @gmap: the gmap whose ASCE needs to be replaced * + * If the ASCE is a SEGMENT type then this function will return -EINVAL, + * otherwise the pointers in the host_to_guest radix tree will keep pointing + * to the wrong pages, causing use-after-free and memory corruption. * If the allocation of the new top level page table fails, the ASCE is not * replaced. * In any case, the old ASCE is always removed from the gmap CRST list. @@ -2854,6 +2857,10 @@ int s390_replace_asce(struct gmap *gmap) s390_unlist_old_asce(gmap); + /* Replacing segment type ASCEs would cause serious issues */ + if ((gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT) + return -EINVAL; + page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); if (!page) return -ENOMEM; |