leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MIPS: KVM: Add missing gfn range check

Browse Source 
kvm_mips_handle_mapped_seg_tlb_fault() calculates the guest frame number
based on the guest TLB EntryLo values, however it is not range checked
to ensure it lies within the guest_pmap. If the physical memory the
guest refers to is out of range then dump the guest TLB and emit an
internal error.

Fixes: 858dd5d457 ("KVM/MIPS32: MMU/TLB operations for the Guest.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Cc: <stable@vger.kernel.org> # 3.10.x-
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
This commit is contained in:
James Hogan 2016-08-11 11:58:13 +01:00 committed by Radim Krčmář
parent c604cffa93
commit 8985d50382
1 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
arch/mips/kvm/mmu.c
View File

@ -138,6 +138,7 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
struct kvm *kvm = vcpu->kvm; struct kvm *kvm = vcpu->kvm;
kvm_pfn_t pfn0, pfn1; kvm_pfn_t pfn0, pfn1;
gfn_t gfn0, gfn1;
long tlb_lo[2]; long tlb_lo[2];
int ret; int ret;
@ -152,18 +153,24 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
VPN2_MASK & (PAGE_MASK << 1))) VPN2_MASK & (PAGE_MASK << 1)))
tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[0]) gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;
>> PAGE_SHIFT) < 0) gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;
if (gfn0 >= kvm->arch.guest_pmap_npages ||
gfn1 >= kvm->arch.guest_pmap_npages) {
kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n",
__func__, gfn0, gfn1, tlb->tlb_hi);
kvm_mips_dump_guest_tlbs(vcpu);
return -1;
}
if (kvm_mips_map_page(kvm, gfn0) < 0)
return -1; return -1;
if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb_lo[1]) if (kvm_mips_map_page(kvm, gfn1) < 0)
>> PAGE_SHIFT) < 0)
return -1; return -1;
pfn0 = kvm->arch.guest_pmap[ pfn0 = kvm->arch.guest_pmap[gfn0];
mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT]; pfn1 = kvm->arch.guest_pmap[gfn1];
pfn1 = kvm->arch.guest_pmap[
mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT];
/* Get attributes from the Guest TLB */ /* Get attributes from the Guest TLB */
entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) |