Skip to content

KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

Bugzilla: https://bugzilla.redhat.com/2166426 CVE: CVE-2021-43056 Conflicts: 1: Applied upstream commit 9b4416c5095c20e110c82ae602c254099b83b72f before the problem solving commit (cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337) to make it apply cleanly. 2: Applied commit c504a77776336022bb93d0003bc674e10fc88752, to fix a bug introduced by 9b4416c5095c20e110c82ae602c254099b83b72f

    KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest

    We call idle_kvm_start_guest() from power7_offline() if the thread has
    been requested to enter KVM. We pass it the SRR1 value that was returned
    from power7_idle_insn() which tells us what sort of wakeup we're
    processing.

    Depending on the SRR1 value we pass in, the KVM code might enter the
    guest, or it might return to us to do some host action if the wakeup
    requires it.

    If idle_kvm_start_guest() is able to handle the wakeup, and enter the
    guest it is supposed to indicate that by returning a zero SRR1 value to
    us.

    That was the behaviour prior to commit 10d91611f426 ("powerpc/64s:
    Reimplement book3s idle code in C"), however in that commit the
    handling of SRR1 was reworked, and the zeroing behaviour was lost.

    Returning from idle_kvm_start_guest() without zeroing the SRR1 value can
    confuse the host offline code, causing the guest to crash and other
    weirdness.

    Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
    Cc: stable@vger.kernel.org # v5.2+
    Signed-off-by: Michael Ellerman's avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20211015133929.832061-2-mpe@ellerman.id.au

Signed-off-by: Jon Maloy jmaloy@redhat.com

Edited by Jon Maloy

Merge request reports