From patchwork Thu Apr 2 18:48:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Hildenbrand X-Patchwork-Id: 11471259 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8F8F51668 for ; Thu, 2 Apr 2020 18:48:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D1A0206E9 for ; Thu, 2 Apr 2020 18:48:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="arvEbHvA" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390052AbgDBSs6 (ORCPT ); Thu, 2 Apr 2020 14:48:58 -0400 Received: from us-smtp-2.mimecast.com ([205.139.110.61]:47882 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2389105AbgDBSsb (ORCPT ); Thu, 2 Apr 2020 14:48:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1585853310; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bo/SIfmVuQxtNcfVHbbkR511KgXolpkFsV3XDhMlwBo=; b=arvEbHvAqLMl1YJezW81qlJxfrF92UbUcwN8mYARLODqVN4fGOz+xSUJN2SRVvc8euOZZC tgHWfQqhUhkCpOv7XoctpvaFZGKfKvSym5w+XySy5NvoFUTYd9pIbgrS7t34qVH6eR6vB+ bSW8OFSWQwrEQ+vYCfOwQbaImaW6zqQ= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-408-zGOKMzHDPR6yJnmedVHzOQ-1; Thu, 02 Apr 2020 14:48:29 -0400 X-MC-Unique: zGOKMzHDPR6yJnmedVHzOQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 6946A8017F5; Thu, 2 Apr 2020 18:48:27 +0000 (UTC) Received: from t480s.redhat.com (ovpn-114-29.ams2.redhat.com [10.36.114.29]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5B1D660BF3; Thu, 2 Apr 2020 18:48:25 +0000 (UTC) From: David Hildenbrand To: kvm@vger.kernel.org Cc: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, Vasily Gorbik , Heiko Carstens , Cornelia Huck , Janosch Frank , Christian Borntraeger , David Hildenbrand , stable@vger.kernel.org Subject: [PATCH v1 1/5] KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks Date: Thu, 2 Apr 2020 20:48:15 +0200 Message-Id: <20200402184819.34215-2-david@redhat.com> In-Reply-To: <20200402184819.34215-1-david@redhat.com> References: <20200402184819.34215-1-david@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org In case we have a region 1 ASCE, our shadow/g3 address can have any value. Unfortunately, (-1UL << 64) is undefined and triggers sometimes, rejecting valid shadow addresses when trying to walk our shadow table hierarchy. The result is that the prefix cannot get mapped and will loop basically forever trying to map it (-EAGAIN loop). After all, the broken check is only a sanity check, our table shadowing code in kvm_s390_shadow_tables() already checks these conditions, injecting proper translation exceptions. Turn it into a WARN_ON_ONCE(). Fixes: 4be130a08420 ("s390/mm: add shadow gmap support") Cc: # v4.8+ Reported-by: Janosch Frank Signed-off-by: David Hildenbrand Tested-by: Janosch Frank --- arch/s390/mm/gmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 2fbece47ef6f..f3dbc5bdde50 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmap *gmap, unsigned long start, static inline unsigned long *gmap_table_walk(struct gmap *gmap, unsigned long gaddr, int level) { + const int asce_type = gmap->asce & _ASCE_TYPE_MASK; unsigned long *table; if ((gmap->asce & _ASCE_TYPE_MASK) + 4 < (level * 4)) return NULL; if (gmap_is_shadow(gmap) && gmap->removed) return NULL; - if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11))) + + if (WARN_ON_ONCE(asce_type != _ASCE_TYPE_REGION1) && + gaddr & (-1UL << (31 + (asce_type >> 2) * 11))) return NULL; + table = gmap->table; switch (gmap->asce & _ASCE_TYPE_MASK) { case _ASCE_TYPE_REGION1: