All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kurz <groug@kaod.org>
To: kvm@vger.kernel.org
Cc: kvm-ppc@vger.kernel.org, Paul Mackerras <paulus@samba.org>,
	David Gibson <david@gibson.dropbear.id.au>,
	Sam Bobroff <sam.bobroff@au1.ibm.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	linuxppc-dev@lists.ozlabs.org, stable@vger.kernel.org
Subject: [PATCH] KVM: PPC: fix oops when checking KVM_CAP_PPC_HTM
Date: Thu, 14 Sep 2017 23:56:25 +0200	[thread overview]
Message-ID: <150542618501.6859.11512107352972110416.stgit@bahia.lan> (raw)

The following program causes a kernel oops:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>

main()
{
    int fd = open("/dev/kvm", O_RDWR);
    ioctl(fd, KVM_CHECK_EXTENSION, KVM_CAP_PPC_HTM);
}

This happens because when using the global KVM fd with
KVM_CHECK_EXTENSION, kvm_vm_ioctl_check_extension() gets
called with a NULL kvm argument, which gets dereferenced
in is_kvmppc_hv_enabled(). Spotted while reading the code.

Let's use the hv_enabled fallback variable, like everywhere
else in this function.

Fixes: 23528bb21ee2 ("KVM: PPC: Introduce KVM_CAP_PPC_HTM")
Cc: stable@vger.kernel.org # v4.7+
Signed-off-by: Greg Kurz <groug@kaod.org>
---
 arch/powerpc/kvm/powerpc.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 3480faaf1ef8..ee279c7f4802 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -644,8 +644,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 		break;
 #endif
 	case KVM_CAP_PPC_HTM:
-		r = cpu_has_feature(CPU_FTR_TM_COMP) &&
-		    is_kvmppc_hv_enabled(kvm);
+		r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled;
 		break;
 	default:
 		r = 0;

WARNING: multiple messages have this Message-ID (diff)
From: Greg Kurz <groug@kaod.org>
To: kvm@vger.kernel.org
Cc: kvm-ppc@vger.kernel.org, Paul Mackerras <paulus@samba.org>,
	David Gibson <david@gibson.dropbear.id.au>,
	Sam Bobroff <sam.bobroff@au1.ibm.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	linuxppc-dev@lists.ozlabs.org, stable@vger.kernel.org
Subject: [PATCH] KVM: PPC: fix oops when checking KVM_CAP_PPC_HTM
Date: Thu, 14 Sep 2017 21:56:25 +0000	[thread overview]
Message-ID: <150542618501.6859.11512107352972110416.stgit@bahia.lan> (raw)

The following program causes a kernel oops:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>

main()
{
    int fd = open("/dev/kvm", O_RDWR);
    ioctl(fd, KVM_CHECK_EXTENSION, KVM_CAP_PPC_HTM);
}

This happens because when using the global KVM fd with
KVM_CHECK_EXTENSION, kvm_vm_ioctl_check_extension() gets
called with a NULL kvm argument, which gets dereferenced
in is_kvmppc_hv_enabled(). Spotted while reading the code.

Let's use the hv_enabled fallback variable, like everywhere
else in this function.

Fixes: 23528bb21ee2 ("KVM: PPC: Introduce KVM_CAP_PPC_HTM")
Cc: stable@vger.kernel.org # v4.7+
Signed-off-by: Greg Kurz <groug@kaod.org>
---
 arch/powerpc/kvm/powerpc.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 3480faaf1ef8..ee279c7f4802 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -644,8 +644,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 		break;
 #endif
 	case KVM_CAP_PPC_HTM:
-		r = cpu_has_feature(CPU_FTR_TM_COMP) &&
-		    is_kvmppc_hv_enabled(kvm);
+		r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled;
 		break;
 	default:
 		r = 0;


             reply	other threads:[~2017-09-14 23:15 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-14 21:56 Greg Kurz [this message]
2017-09-14 21:56 ` [PATCH] KVM: PPC: fix oops when checking KVM_CAP_PPC_HTM Greg Kurz
2017-09-15  0:48 ` David Gibson
2017-09-15  0:48   ` David Gibson
2017-09-15  5:52   ` Greg Kurz
2017-09-15  5:52     ` Greg Kurz
2017-09-15  5:52     ` Greg Kurz
2017-09-15  6:54     ` Greg Kurz
2017-09-15  6:54       ` Greg Kurz
2017-09-15  8:59     ` David Gibson
2017-09-15  8:59       ` David Gibson
2017-09-18  6:16       ` Thomas Huth
2017-09-18  6:16         ` Thomas Huth
2017-10-12 11:27 ` Michael Ellerman
2017-10-12 11:27   ` Michael Ellerman
2017-10-12 12:51   ` Greg Kurz
2017-10-12 12:51     ` Greg Kurz
2017-10-12 22:20     ` David Gibson
2017-10-12 22:20       ` David Gibson
2017-10-12 23:16 ` Greg Kurz
2017-10-12 23:16   ` Greg Kurz
2017-10-13 16:14   ` Paolo Bonzini
2017-10-13 16:14     ` Paolo Bonzini
2017-10-14  1:23     ` Paul Mackerras
2017-10-14  1:23       ` Paul Mackerras
2017-10-14  1:23 ` Paul Mackerras
2017-10-14  1:23   ` Paul Mackerras

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=150542618501.6859.11512107352972110416.stgit@bahia.lan \
    --to=groug@kaod.org \
    --cc=david@gibson.dropbear.id.au \
    --cc=kvm-ppc@vger.kernel.org \
    --cc=kvm@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=paulus@samba.org \
    --cc=pbonzini@redhat.com \
    --cc=sam.bobroff@au1.ibm.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.