From patchwork Mon Feb 14 14:08:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1592608 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=OfS7q0yn; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4Jy5hH22Fnz9s0r for ; Tue, 15 Feb 2022 01:09:51 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1nJc2z-0001bm-N9; Mon, 14 Feb 2022 14:09:45 +0000 Received: from smtp-relay-canonical-0.internal ([10.131.114.83] helo=smtp-relay-canonical-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1nJc2y-0001bf-SV for kernel-team@lists.ubuntu.com; Mon, 14 Feb 2022 14:09:44 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-0.canonical.com (Postfix) with ESMTPSA id BBBA13F1DF for ; Mon, 14 Feb 2022 14:09:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1644847784; bh=109hS/DedR1buboOqCExL2AYbX1sFJv8mQKPalDiKhE=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=OfS7q0yn7jfDxcBX8zgmpi/cbo55hsyv1ex7TxiYIsKEEzPSySfSsWVKmKXVypcBG OZgKDLqMxY/bDR6xxI+TnOen+JzIVdZcX0uqKfZTDkDffzCOWo9GAkSk1VYjY/RlXl 5AiMpQ89QSZ6NzKC0wv3Q5Hpjkac5WI+/5TLr5AOvvWMadv3JIQYs55qB1YGs0i5rT 5qAb8YPOCuohzXmGckpb4fpeBobpvROEhVMMYXf1Zm4a3vZoWouJG5ogOX/Y+dPmeb 3wUW09CJMqzy+H8ZoCr6pfqBbMa6jczI1kIj338GuRqf5V5N4XLlsVcfKvKwzKSmsF wNXsot0oOmJaA== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU Focal/Impish/Jammy] KVM: s390: Return error on SIDA memop on normal guest Date: Mon, 14 Feb 2022 11:08:42 -0300 Message-Id: <20220214140842.236308-1-cascardo@canonical.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Janis Schoetterl-Glausch Refuse SIDA memops on guests which are not protected. For normal guests, the secure instruction data address designation, which determines the location we access, is not under control of KVM. Fixes: 19e122776886 (KVM: S390: protvirt: Introduce instruction data area bounce buffer) Signed-off-by: Janis Schoetterl-Glausch Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger (cherry picked from commit 2c212e1baedcd782b2535a3f86bc491977677c0e) CVE-2022-0516 Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Tim Gardner Acked-by: Stefan Bader --- arch/s390/kvm/kvm-s390.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 08c1c8944f40..817f4deaae2d 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -4641,6 +4641,8 @@ static long kvm_s390_guest_sida_op(struct kvm_vcpu *vcpu, return -EINVAL; if (mop->size + mop->sida_offset > sida_size(vcpu->arch.sie_block)) return -E2BIG; + if (!kvm_s390_pv_cpu_is_protected(vcpu)) + return -EINVAL; switch (mop->op) { case KVM_S390_MEMOP_SIDA_READ: