linux-stable/arch/s390/kernel
David Hildenbrand eadbd5d1ec s390/uv: fully validate the VMA before calling follow_page()
[ Upstream commit 46c22ffd27 ]

We should not walk/touch page tables outside of VMA boundaries when
holding only the mmap sem in read mode. Evil user space can modify the
VMA layout just before this function runs and e.g., trigger races with
page table removal code since commit dd2283f260 ("mm: mmap: zap pages
with read mmap_sem in munmap").

find_vma() does not check if the address is >= the VMA start address;
use vma_lookup() instead.

Fixes: 214d9bbcd3 ("s390/mm: provide memory management functions for protected KVM guests")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Link: https://lore.kernel.org/r/20210909162248.14969-6-david@redhat.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 19:16:40 +01:00
..
syscalls compat: remove some compat entry points 2021-09-08 15:32:35 -07:00
vdso32 s390 updates for 5.15 merge window 2021-08-30 13:07:15 -07:00
vdso64 s390 updates for 5.15 merge window 2021-08-30 13:07:15 -07:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
alternative.c s390/facilities: move stfl information from lowcore to global data 2021-06-07 17:06:58 +02:00
asm-offsets.c s390/smp: enable DAT before CPU restart callback is called 2021-08-26 20:22:12 +02:00
audit.c
audit.h
base.S s390: remove unused s390_base_ext_handler 2020-11-09 11:20:58 +01:00
cache.c
compat_audit.c
compat_linux.c
compat_linux.h
compat_ptrace.h
compat_signal.c s390/signal: switch to using vdso for sigreturn and syscall restart 2021-07-08 22:09:47 +02:00
cpcmd.c s390/cpcmd: use register pair instead of register asm 2021-06-18 16:41:22 +02:00
crash_dump.c s390/dump: introduce boot data 'oldmem_data' 2021-07-27 09:39:16 +02:00
debug.c s390/sclp: add tracing of SCLP interactions 2021-08-25 11:03:35 +02:00
diag.c s390: rename dma section to amode31 2021-08-05 14:10:53 +02:00
dis.c s390/disassembler: add instructions 2021-07-27 09:39:19 +02:00
dumpstack.c s390/unwind: add machine check handler stack 2021-04-05 11:30:07 +02:00
early.c s390: make PCI mio support a machine flag 2021-07-27 09:39:19 +02:00
early_printk.c s390/sclp: remove unused sclp_early_printk_forced 2020-09-21 08:08:44 +02:00
ebcdic.c
entry.h s390: remove do_signal() prototype and do_notify_resume() function 2021-08-25 11:03:34 +02:00
entry.S s390/entry: make oklabel within CHKSTG macro local 2021-08-31 14:54:15 +02:00
fpu.c s390: convert to generic entry 2021-01-19 12:29:26 +01:00
ftrace.c s390/ftrace: remove incorrect __va usage 2021-09-08 14:23:31 +02:00
ftrace.h s390/ftrace: implement hotpatching 2021-08-03 14:31:40 +02:00
guarded_storage.c
head64.S s390/boot: move dma sections from decompressor to decompressed kernel 2021-07-27 09:39:17 +02:00
idle.c s390/time,idle: get rid of unsigned long long 2021-03-08 10:46:27 +01:00
ima_arch.c
ipl.c s390/smp: enable DAT before CPU restart callback is called 2021-08-26 20:22:12 +02:00
ipl_vmparm.c s390/cio: remove unused include linux/spinlock.h from cio.h 2021-07-27 09:39:13 +02:00
irq.c s390: replace deprecated CPU-hotplug functions 2021-08-05 14:10:53 +02:00
jump_label.c s390/jump_label: print real address in a case of a jump label bug 2021-07-27 09:39:13 +02:00
kdebugfs.c
kexec_elf.c kexec: Fix file verification on S390 2019-09-10 13:27:51 +01:00
kexec_image.c kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE 2019-08-19 21:54:15 -07:00
kprobes.c s390/kprobes: use is_kernel() helper 2021-07-05 12:44:23 +02:00
kprobes_insn_page.S s390/kprobes: move insn_page to text segment 2020-10-09 23:45:30 +02:00
lgr.c s390: convert to msecs_to_jiffies() 2020-06-29 16:31:46 +02:00
machine_kexec.c s390/smp: enable DAT before CPU restart callback is called 2021-08-26 20:22:12 +02:00
machine_kexec_file.c s390/kexec_file: fix initrd location for kdump kernel 2020-05-14 23:21:37 +02:00
machine_kexec_reloc.c s390/kaslr: add support for R_390_JMP_SLOT relocation type 2020-05-20 10:13:27 +02:00
Makefile s390: rename dma section to amode31 2021-08-05 14:10:53 +02:00
mcount.S s390/ftrace: fix ftrace_update_ftrace_func implementation 2021-07-15 12:54:58 +02:00
module.c s390/ftrace: implement hotpatching 2021-08-03 14:31:40 +02:00
nmi.c s390/mcck: move register validation to C code 2021-07-05 12:44:23 +02:00
nospec-branch.c s390/speculation: Use statically initialized const for instructions 2021-06-28 11:18:28 +02:00
nospec-sysfs.c s390/facilities: move stfl information from lowcore to global data 2021-06-07 17:06:58 +02:00
numa.c s390/numa: move code to arch/s390/kernel 2020-08-11 18:16:55 +02:00
os_info.c s390/dump: introduce boot data 'oldmem_data' 2021-07-27 09:39:16 +02:00
perf_cpum_cf.c s390/cpum_cf: move array from header to C file 2021-09-07 13:38:41 +02:00
perf_cpum_cf_common.c s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility 2021-07-05 12:44:23 +02:00
perf_cpum_cf_events.c s390/cpum_cf,perf: change DFLT_CCERROR counter name 2020-07-21 13:53:56 +02:00
perf_cpum_sf.c s390/time: convert tod_clock_base to union 2021-02-13 17:17:54 +01:00
perf_event.c s390: Get rid of oprofile leftovers 2021-04-22 13:32:39 +01:00
perf_regs.c perf/arch: Remove perf_sample_data::regs_user_copy 2020-11-09 18:12:34 +01:00
process.c s390/signal: switch to using vdso for sigreturn and syscall restart 2021-07-08 22:09:47 +02:00
processor.c s390: replace deprecated CPU-hotplug functions 2021-08-05 14:10:53 +02:00
ptrace.c s390/traps: add struct to access transactional diagnostic block 2021-06-07 17:06:58 +02:00
reipl.S
relocate_kernel.S
runtime_instr.c s390/runtime_instrumentation: fix storage key handling 2020-08-17 13:17:10 +02:00
setup.c 2nd batch of s390 updates for 5.15 merge window 2021-09-09 12:55:12 -07:00
signal.c s390: remove do_signal() prototype and do_notify_resume() function 2021-08-25 11:03:34 +02:00
smp.c s390/topology: fix topology information when calling cpu hotplug notifiers 2021-09-07 13:38:41 +02:00
stacktrace.c stacktrace: Move documentation for arch_stack_walk_reliable() to header 2021-03-10 15:52:31 +01:00
sthyi.c s390/sthyi: use register pair instead of register asm 2021-06-18 16:41:22 +02:00
syscall.c s390: rename PIF_SYSCALL_RESTART to PIF_EXECVE_PGSTE_RESTART 2021-07-08 22:12:17 +02:00
sysinfo.c s390/sysinfo: get rid of register asm 2021-06-18 16:41:23 +02:00
text_amode31.S s390/diag: make restart_part2 a local label 2021-08-25 11:03:34 +02:00
time.c s390/vdso: fix initializing and updating of vdso_data 2021-03-25 21:57:26 +01:00
topology.c s390/topology: fix topology information when calling cpu hotplug notifiers 2021-09-07 13:38:41 +02:00
trace.c s390/ftrace: fix potential crashes when switching tracers 2020-04-22 16:20:55 +02:00
traps.c s390: rename dma section to amode31 2021-08-05 14:10:53 +02:00
unwind_bc.c s390/unwind: stop gracefully at user mode pt_regs in irq stack 2019-12-18 23:29:26 +01:00
uprobes.c s390: Fix fall-through warnings for Clang 2021-07-13 14:43:09 -05:00
uv.c s390/uv: fully validate the VMA before calling follow_page() 2021-11-18 19:16:40 +01:00
vdso.c s390/vdso: add minimal compat vdso 2021-07-08 15:37:28 +02:00
vmlinux.lds.S s390: fix typo in linker script 2021-08-25 11:03:34 +02:00
vtime.c s390/vtime: fix increased steal time accounting 2021-03-15 19:09:25 +01:00