KVM: s390: Unlink vcpu on destroy - v2

This patch makes sure we do unlink a vcpu's sie control block
from the system control area in kvm_arch_vcpu_destroy. This
prevents illegal accesses to the sie control block from other
virtual cpus after free.

Reported-by: Mijo Safradin <mijo@linux.vnet.ibm.com>
Signed-off-by: Carsten Otte <cotte@de.ibm.com>
Signed-off-by: Christian Ehrhardt <ehrhardt@de.ibm.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 36c654d2d64a2341ef4f00b183908665f068cf8a..628494a434251c2f4ffb816981f793c849eeb2e9 100644 (file)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -196,6 +196,10 @@ out_nokvm:
 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
        VCPU_EVENT(vcpu, 3, "%s", "free cpu");
+       if (vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda ==
+               (__u64) vcpu->arch.sie_block)
+               vcpu->kvm->arch.sca->cpu[vcpu->vcpu_id].sda = 0;
+       smp_mb();
        free_page((unsigned long)(vcpu->arch.sie_block));
        kvm_vcpu_uninit(vcpu);
        kfree(vcpu);
@@ -310,8 +314,10 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 
        vcpu->arch.sie_block->icpua = id;
        BUG_ON(!kvm->arch.sca);
-       BUG_ON(kvm->arch.sca->cpu[id].sda);
-       kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block;
+       if (!kvm->arch.sca->cpu[id].sda)
+               kvm->arch.sca->cpu[id].sda = (__u64) vcpu->arch.sie_block;
+       else
+               BUG_ON(!kvm->vcpus[id]); /* vcpu does already exist */
        vcpu->arch.sie_block->scaoh = (__u32)(((__u64)kvm->arch.sca) >> 32);
        vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;