github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

powerpc fixes for 7.3 #4

Browse Source 
- PPC/KVM - fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
  - PPC/KVM - fix secure device page leak on uv_page_in() failure
  - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
 
 Thanks to: Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R Nageswara
 Sastry, Shivaprasad G Bhat
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmqqUzQACgkQpnEsdPSH
 ZJQMwQ//fJnux3DlGo3zXbwGpckd3LGj/WfA7RLtk9jQTk7DUzzjArGHpk5o/CGl
 99e8udaGxCuQNHEqGJg6bSTNPBlkMoaxYpMkf2mL73l1XXJiKz3aZs1iRlTdQGfK
 v6TysjjB2lYstvPskoT+imODAg6ebDMHQV8Kh67DIRCY2tJrZgxBYbESBiS1q9Qq
 KDL3DXpDxdczTDltpypvoqdZTBNpM63wgUMVcaquYckPwM6gRy3VWJchx8FPuZCR
 JcIfowPTYKDSKI0+IyFENfeXAgZOMLih0QVWY1yN+JFs3gXhQ5aFeWwLdNinW4Sw
 tPCB6Nc9R/XZlgzHgIvBuLZONbmG7uhSe4907rOucfXQIU5klMRzasfRDsBwDWqy
 P3EdMd053JmRs+upQLI1UoVuorYRE1ry2vCQr3xpP32tjTAX/qTsSPhQ0LxXWkUI
 B6Yr2bXjxngWCJVpM9XN45L8oAHELeigQ14cIS1o8hp+8NHctlWVvE+Shd/L2ELE
 Q5Lx/svwuwGcB6BI9xSwQUCcib+NH2soiScb2qv9PuZguP0W1nRIUJj37UqA379/
 wlc/5GtCHcK8PxFwaf4YYUulg/1gjUXYAmEN8lguiiqT0n1qgrDws1WDjnd6F+xj
 O3rAxH+hfxwOu4u/P7QXYgqlULUZHbdU7PqFnrpmzHlllaEIHpw=
 =YcTl
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Madhavan Srinivasan:
 "KVM:
    - fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
    - fix secure device page leak on uv_page_in() failure

  iommu:
    - Fix the overflow validation in iommu_tce_check_ioba

  Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
  Nageswara Sastry, and Shivaprasad G Bhat"

* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
  KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
  KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
This commit is contained in:
Linus Torvalds 2026-09-16 09:29:25 -07:00
commit 238650ef6c
3 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
arch/powerpc/kernel/iommu.c
View File

@ -1076,7 +1076,7 @@ int iommu_tce_check_ioba(unsigned long page_shift,
if (ioba < offset)
return -EINVAL;
if ((ioba + 1) > (offset + size))
if ((ioba + npages < ioba) || (ioba - offset + npages > size))
return -EINVAL;
return 0;

2
arch/powerpc/kvm/book3s_hv_nested.c
View File

@ -1204,8 +1204,10 @@ static void kvmhv_emulate_tlbie_all_lpid(struct kvm_vcpu *vcpu, int ric)
spin_lock(&kvm->mmu_lock);
idr_for_each_entry(&kvm->arch.kvm_nested_guest_idr, gp, lpid) {
++gp->refcnt;
spin_unlock(&kvm->mmu_lock);
kvmhv_emulate_tlbie_lpid(vcpu, gp, ric);
kvmhv_put_nested(gp);
spin_lock(&kvm->mmu_lock);
}
spin_unlock(&kvm->mmu_lock);

5
arch/powerpc/kvm/book3s_hv_uvmem.c
View File

@ -779,8 +779,11 @@ static int kvmppc_svm_page_in(struct vm_area_struct *vma,
if (spage) {
ret = uv_page_in(kvm->arch.lpid, pfn << page_shift,
gpa, 0, page_shift);
if (ret)
if (ret) {
unlock_page(dpage);
put_page(dpage);
goto out_finalize;
}
}
}