linux-kernel - Re: [PATCH v1 1/1] KVM: s390: VSIE: fix virtual/physical address in unpin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <D680YIBTB8K9.3JYA0MCKDK0H9@linux.ibm.com>
Date: Tue, 10 Dec 2024 13:38:04 +0100
From: "Nico Boehr" <nrb@...ux.ibm.com>
To: "Claudio Imbrenda" <imbrenda@...ux.ibm.com>, <kvm@...r.kernel.org>
Cc: <linux-s390@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <frankja@...ux.ibm.com>, <borntraeger@...ibm.com>
Subject: Re: [PATCH v1 1/1] KVM: s390: VSIE: fix virtual/physical address in
 unpin_scb()

On Tue Dec 10, 2024 at 9:39 AM CET, Claudio Imbrenda wrote:
> In commit 77b533411595 ("KVM: s390: VSIE: sort out virtual/physical
> address in pin_guest_page"), only pin_scb() has been updated. This
> means that in unpin_scb() a virtual address was still used directly as
> physical address without conversion. The resulting physical address is
> obviously wrong and most of the time also invalid.
>
> Since commit d0ef8d9fbebe ("KVM: s390: Use kvm_release_page_dirty() to
> unpin "struct page" memory"), unpin_guest_page() will directly use
> kvm_release_page_dirty(), instead of kvm_release_pfn_dirty(), which has
> since been removed.
>
> One of the checks that were performed by kvm_release_pfn_dirty() was to
> verify whether the page was valid at all, and silently return
> successfully without doing anything if the page was invalid.
>
> When kvm_release_pfn_dirty() was still used, the invalid page was thus
> silently ignored. Now the check is gone and the result is an Oops.
> This also means that when running with a V!=R kernel, the page was not
> released, causing a leak.
>
> The solution is simply to add the missing virt_to_phys().
>
> Signed-off-by: Claudio Imbrenda <imbrenda@...ux.ibm.com>
> Fixes: 77b533411595 ("KVM: s390: VSIE: sort out virtual/physical address in pin_guest_page")

Reviewed-by: Nico Boehr <nrb@...ux.ibm.com>