Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 22:19:30 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Browse Source 
Pull powerpc fixes from Madhavan Srinivasan:
 "KVM:
    - fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
    - fix secure device page leak on uv_page_in() failure

  iommu:
    - Fix the overflow validation in iommu_tce_check_ioba

  Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
  Nageswara Sastry, and Shivaprasad G Bhat"

* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
  KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
  KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
This commit is contained in:
Linus Torvalds
2026-09-16 09:29:25 -07:00
parent 9b87fdc9af 0b271f7d7f
commit 238650ef6c
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/powerpc/kernel/iommu.c
+1 -1
View File
@@ -1076,7 +1076,7 @@ int iommu_tce_check_ioba(unsigned long page_shift,
if (ioba < offset) if (ioba < offset)
return -EINVAL; return -EINVAL;
if ((ioba + 1) > (offset + size)) if ((ioba + npages < ioba) || (ioba - offset + npages > size))
return -EINVAL; return -EINVAL;
return 0; return 0;
arch/powerpc/kvm/book3s_hv_nested.c
+2
View File
@@ -1204,8 +1204,10 @@ static void kvmhv_emulate_tlbie_all_lpid(struct kvm_vcpu *vcpu, int ric)
spin_lock(&kvm->mmu_lock); spin_lock(&kvm->mmu_lock);
idr_for_each_entry(&kvm->arch.kvm_nested_guest_idr, gp, lpid) { idr_for_each_entry(&kvm->arch.kvm_nested_guest_idr, gp, lpid) {
++gp->refcnt;
spin_unlock(&kvm->mmu_lock); spin_unlock(&kvm->mmu_lock);
kvmhv_emulate_tlbie_lpid(vcpu, gp, ric); kvmhv_emulate_tlbie_lpid(vcpu, gp, ric);
kvmhv_put_nested(gp);
spin_lock(&kvm->mmu_lock); spin_lock(&kvm->mmu_lock);
} }
spin_unlock(&kvm->mmu_lock); spin_unlock(&kvm->mmu_lock);
arch/powerpc/kvm/book3s_hv_uvmem.c
+4 -1
View File
@@ -779,8 +779,11 @@ static int kvmppc_svm_page_in(struct vm_area_struct *vma,
if (spage) { if (spage) {
ret = uv_page_in(kvm->arch.lpid, pfn << page_shift, ret = uv_page_in(kvm->arch.lpid, pfn << page_shift,
gpa, 0, page_shift); gpa, 0, page_shift);
if (ret) if (ret) {
unlock_page(dpage);
put_page(dpage);
goto out_finalize; goto out_finalize;
}
} }
} }