diff options
| author | Christian Borntraeger <borntraeger@de.ibm.com> | 2014-08-19 16:19:35 +0200 |
|---|---|---|
| committer | Christian Borntraeger <borntraeger@de.ibm.com> | 2014-08-25 14:35:28 +0200 |
| commit | ab3f285f227fec62868037e9b1b1fd18294a83b8 (patch) | |
| tree | 223d790283f4379ce84a87660d100a1f1933cffd /arch | |
| parent | KVM: s390: Fix user triggerable bug in dead code (diff) | |
| download | linux-ab3f285f227fec62868037e9b1b1fd18294a83b8.tar.xz linux-ab3f285f227fec62868037e9b1b1fd18294a83b8.zip | |
KVM: s390/mm: try a cow on read only pages for key ops
The PFMF instruction handler blindly wrote the storage key even if
the page was mapped R/O in the host. Lets try a COW before continuing
and bail out in case of errors.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/s390/mm/pgtable.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c index 19daa53a3da4..5404a6261db9 100644 --- a/arch/s390/mm/pgtable.c +++ b/arch/s390/mm/pgtable.c @@ -986,11 +986,21 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep; down_read(&mm->mmap_sem); +retry: ptep = get_locked_pte(current->mm, addr, &ptl); if (unlikely(!ptep)) { up_read(&mm->mmap_sem); return -EFAULT; } + if (!(pte_val(*ptep) & _PAGE_INVALID) && + (pte_val(*ptep) & _PAGE_PROTECT)) { + pte_unmap_unlock(*ptep, ptl); + if (fixup_user_fault(current, mm, addr, FAULT_FLAG_WRITE)) { + up_read(&mm->mmap_sem); + return -EFAULT; + } + goto retry; + } new = old = pgste_get_lock(ptep); pgste_val(new) &= ~(PGSTE_GR_BIT | PGSTE_GC_BIT | |