s390x/kvm: clamp stsi 3.2.2 size

[PATCH] s390x/kvm: clamp stsi 3.2.2 size

Christian Borntraeger posted 1 patch 1 month ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260622092035.400959-1-borntraeger@linux.ibm.com

Maintainers: Halil Pasic <pasic@linux.ibm.com>, Christian Borntraeger <borntraeger@linux.ibm.com>, Eric Farman <farman@linux.ibm.com>, Matthew Rosato <mjrosato@linux.ibm.com>, Richard Henderson <richard.henderson@linaro.org>, Ilya Leoshkevich <iii@linux.ibm.com>, David Hildenbrand <david@kernel.org>, Cornelia Huck <cohuck@redhat.com>

target/s390x/kvm/kvm.c | 9 +++++++++
1 file changed, 9 insertions(+)

Expand all Fold all

[PATCH] s390x/kvm: clamp stsi 3.2.2 size

Posted by Christian Borntraeger 1 month ago

The stsi 3.2.2 page is being prepared by the kvm module and the size is
clamped by the kernel. As the memory is mapped in the guest, another
guest VCPU could race and overwrite the count and messing up the move
operation. For any out of bound count, fall back to the kernel buffer.

Cc: qemu-stable@nongnu.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
 target/s390x/kvm/kvm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index ed8cd6b410..a3835573bb 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
     } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib))) {
         return;
     }
+
+    /*
+     * The memory was filled by the kernel but mapped into the guest.
+     * If something is fishy, do not touch the buffer.
+     */
+    if (sysib.count == 0 || sysib.count > ARRAY_SIZE(sysib.ext_names)) {
+        return;
+    }
+
     /* Shift the stack of Extended Names to prepare for our own data */
     memmove(&sysib.ext_names[1], &sysib.ext_names[0],
             sizeof(sysib.ext_names[0]) * (sysib.count - 1));
-- 
2.53.0

Re: [PATCH] s390x/kvm: clamp stsi 3.2.2 size

Posted by Cornelia Huck 4 weeks, 1 day ago

On Mon, Jun 22 2026, Christian Borntraeger <borntraeger@linux.ibm.com> wrote:

> The stsi 3.2.2 page is being prepared by the kvm module and the size is
> clamped by the kernel. As the memory is mapped in the guest, another
> guest VCPU could race and overwrite the count and messing up the move
> operation. For any out of bound count, fall back to the kernel buffer.
>
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  target/s390x/kvm/kvm.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Thanks, applied.

Re: [PATCH] s390x/kvm: clamp stsi 3.2.2 size

Posted by Eric Farman 1 month ago

On Mon, 2026-06-22 at 11:20 +0200, Christian Borntraeger wrote:
> The stsi 3.2.2 page is being prepared by the kvm module and the size is
> clamped by the kernel. As the memory is mapped in the guest, another
> guest VCPU could race and overwrite the count and messing up the move
> operation. For any out of bound count, fall back to the kernel buffer.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  target/s390x/kvm/kvm.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Looks right to me.

Reviewed-by: Eric Farman <farman@linux.ibm.com>

> 
> diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
> index ed8cd6b410..a3835573bb 100644
> --- a/target/s390x/kvm/kvm.c
> +++ b/target/s390x/kvm/kvm.c
> @@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
>      } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib))) {
>          return;
>      }
> +
> +    /*
> +     * The memory was filled by the kernel but mapped into the guest.
> +     * If something is fishy, do not touch the buffer.
> +     */
> +    if (sysib.count == 0 || sysib.count > ARRAY_SIZE(sysib.ext_names)) {
> +        return;
> +    }
> +
>      /* Shift the stack of Extended Names to prepare for our own data */
>      memmove(&sysib.ext_names[1], &sysib.ext_names[0],
>              sizeof(sysib.ext_names[0]) * (sysib.count - 1));