diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-09-16 09:29:25 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-09-16 09:29:25 -0700 |
| commit | 238650ef6c7c7cca08e032527329424c9fbd70e5 (patch) | |
| tree | ada4d56578c713c59de798ed5b892f337afdf919 /arch/powerpc/kvm | |
| parent | 9b87fdc9af2fbfcdb5c24a64139685ef80f6573f (diff) | |
| parent | 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 (diff) | |
Pull powerpc fixes from Madhavan Srinivasan:
"KVM:
- fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- fix secure device page leak on uv_page_in() failure
iommu:
- Fix the overflow validation in iommu_tce_check_ioba
Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
Nageswara Sastry, and Shivaprasad G Bhat"
* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
Diffstat (limited to 'arch/powerpc/kvm')
| -rw-r--r-- | arch/powerpc/kvm/book3s_hv_nested.c | 2 | ||||
| -rw-r--r-- | arch/powerpc/kvm/book3s_hv_uvmem.c | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/arch/powerpc/kvm/book3s_hv_nested.c b/arch/powerpc/kvm/book3s_hv_nested.c index 22e616662255..a6ff42d7666c 100644 --- a/arch/powerpc/kvm/book3s_hv_nested.c +++ b/arch/powerpc/kvm/book3s_hv_nested.c @@ -1204,8 +1204,10 @@ static void kvmhv_emulate_tlbie_all_lpid(struct kvm_vcpu *vcpu, int ric) spin_lock(&kvm->mmu_lock); idr_for_each_entry(&kvm->arch.kvm_nested_guest_idr, gp, lpid) { + ++gp->refcnt; spin_unlock(&kvm->mmu_lock); kvmhv_emulate_tlbie_lpid(vcpu, gp, ric); + kvmhv_put_nested(gp); spin_lock(&kvm->mmu_lock); } spin_unlock(&kvm->mmu_lock); diff --git a/arch/powerpc/kvm/book3s_hv_uvmem.c b/arch/powerpc/kvm/book3s_hv_uvmem.c index 5fbb95d90e99..463aef870c4e 100644 --- a/arch/powerpc/kvm/book3s_hv_uvmem.c +++ b/arch/powerpc/kvm/book3s_hv_uvmem.c @@ -779,8 +779,11 @@ static int kvmppc_svm_page_in(struct vm_area_struct *vma, if (spage) { ret = uv_page_in(kvm->arch.lpid, pfn << page_shift, gpa, 0, page_shift); - if (ret) + if (ret) { + unlock_page(dpage); + put_page(dpage); goto out_finalize; + } } } |