From: Will Deacon <will@kernel.org>
To: maz@kernel.org
Cc: kernel test robot <lkp@intel.com>, Will Deacon <will@kernel.org>,
Will Deacon <willdeacon@google.com>,
kernel-team@android.com, kvmarm@lists.cs.columbia.edu,
Dan Carpenter <dan.carpenter@oracle.com>
Subject: [PATCH] KVM: arm64: Ensure user_mem_abort() return value is initialised
Date: Wed, 30 Sep 2020 11:24:42 +0100 [thread overview]
Message-ID: <20200930102442.16142-1-will@kernel.org> (raw)
From: Will Deacon <willdeacon@google.com>
If a change in the MMU notifier sequence number forces user_mem_abort()
to return early when attempting to handle a stage-2 fault, we return
uninitialised stack to kvm_handle_guest_abort(), which could potentially
result in the injection of an external abort into the guest or a spurious
return to userspace. Neither or these are what we want to do.
Initialise 'ret' to 0 in user_mem_abort() so that bailing due to a
change in the MMU notrifier sequence number is treated as though the
fault was handled.
Cc: Gavin Shan <gshan@redhat.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Will Deacon <will@kernel.org>
---
Applies on top of kvmarm/next.
arch/arm64/kvm/mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index c5c26a9cb85b..a816cb8e619b 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -742,7 +742,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
struct kvm_memory_slot *memslot, unsigned long hva,
unsigned long fault_status)
{
- int ret;
+ int ret = 0;
bool write_fault, writable, force_pte = false;
bool exec_fault;
bool device = false;
--
2.28.0.709.gb0816b6eb0-goog
_______________________________________________
kvmarm mailing list
kvmarm@lists.cs.columbia.edu
https://lists.cs.columbia.edu/mailman/listinfo/kvmarm
next reply other threads:[~2020-09-30 10:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 10:24 Will Deacon [this message]
2020-09-30 10:30 ` [PATCH] KVM: arm64: Ensure user_mem_abort() return value is initialised Will Deacon
2020-09-30 10:47 ` Alexandru Elisei
2020-10-01 0:59 ` Gavin Shan
2020-10-02 8:20 ` Marc Zyngier
2020-10-02 8:20 ` Marc Zyngier
2020-10-02 8:20 ` Marc Zyngier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200930102442.16142-1-will@kernel.org \
--to=will@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=kernel-team@android.com \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=lkp@intel.com \
--cc=maz@kernel.org \
--cc=willdeacon@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.