Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     David Hildenbrand <david@redhat.com>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        Christian Borntraeger <borntraeger@de.ibm.com>,
        Janosch Frank <frankja@linux.ibm.com>,
        Cornelia Huck <cohuck@redhat.com>,
        Claudio Imbrenda <imbrenda@linux.ibm.com>,
        Heiko Carstens <hca@linux.ibm.com>,
        Vasily Gorbik <gor@linux.ibm.com>,
        Niklas Schnelle <schnelle@linux.ibm.com>,
        Gerald Schaefer <gerald.schaefer@linux.ibm.com>,
        Ulrich Weigand <Ulrich.Weigand@de.ibm.com>
Subject: Re: [PATCH resend RFC 5/9] s390/uv: fully validate the VMA before
 calling follow_page()
Thread-Topic: [PATCH resend RFC 5/9] s390/uv: fully validate the VMA before
 calling follow_page()
Thread-Index: AQHXpZcUo4CShfRFgUS/m3/66qDGNaukKAiA
Date:   Tue, 14 Sep 2021 22:41:12 +0000
Message-ID: <20210914224054.pigma5e3dfyiup44@revolver>
References: <20210909162248.14969-1-david@redhat.com>
 <20210909162248.14969-6-david@redhat.com>
In-Reply-To: <20210909162248.14969-6-david@redhat.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?vwSLcEw/yeD3GeTNt55HY7jFuA8lj66Kdtem8wB503wXBEhXM65yb/QEhG9z?=
 =?us-ascii?Q?e2N+GCt6DGkDkmEQSoNq4djMENqle7MIjOhoGOQOSehHfSpZVntsU7V85Yzi?=
 =?us-ascii?Q?rwjt7DRYerTyccnuYKC60CUNPKs/fzfSHGtTnLVTPu4iad7g1ETFGRD5BRWN?=
 =?us-ascii?Q?BH30hlCF8gbByt9RksZT7JBVbvdTjuTHYM6mErM3Qa40Zg/Ezv3MN4ub7G9u?=
 =?us-ascii?Q?y3WPvCG2xvAI3IImTQxESYYg3T+HONCgByrzmi9OX+EfIBhuDONWia3oUFIh?=
 =?us-ascii?Q?LeY7G4wXnC50Mcokf7Jm5KazXfa9MbbfjAOlAJ3jmH+BoE1WFsJ9Hr5I7xDt?=
 =?us-ascii?Q?MAHU1RBcQdeu71XJZWz9cQUSGx2cOsjw/wXARAf6fFPDeXsoTZtmsSlc8OeO?=
 =?us-ascii?Q?vNXHcHbg+/ltSkhd2iX4uuUSsTBfKud8eR7oecjXlpUHhYe6WoRohKKNvmW9?=
 =?us-ascii?Q?/MrzJ3+XydFRZ7H/Cx85ZlvnMEV4RQHeR6qsRs/ZygDgmrCL1IVSkx23wFyh?=
 =?us-ascii?Q?xucJ2YE2TEpfbpeYxIwHPF6LJ3IsiKXpCDqeMys0rqZ9dwQ+OIkAnlkcUSoh?=
 =?us-ascii?Q?l9bAW4KyWQUYTEM8EyIOpdQlP2Yl6Or/Dss3utftktd90nTj1aKgRhACWR0X?=
 =?us-ascii?Q?e+297NfKNoe0VO5WeT9wor2HXox3uTIY97MofWcP3MbmfaySApntrUYDku1f?=
 =?us-ascii?Q?tV+Xjf5Ea0twfkWR6kWjG9nhvw/h4WZEXR7+ted2TDVnYyrxK9kllymYoman?=
 =?us-ascii?Q?mUGZnUa89L8PRYawQhhoEQZPR7AXriYrIu//C3SDpya59PTuJiK4doUGvvTL?=
 =?us-ascii?Q?trSyl+hbLGdx+3ML1XXQrFivlXoOc3que3OGx1QC9Oy0q5IPwo4CpB91NwIF?=
 =?us-ascii?Q?BgGV3B+Ap2ltbVjJju2XivZDUPIw51mauW8gEX8bMWmpHJIduS5TYyrXIoWx?=
 =?us-ascii?Q?D8tBLcNZffTP1gAo9Qojl1MBe44Hgm14kGEL9Dd3KwBePFue0r/fru7pfzI1?=
 =?us-ascii?Q?dLA94VBsyXUPL6OgA+X4cIzCbtmEstwQIipX2IKQRZrk4si5bkNyV5P0aVY4?=
 =?us-ascii?Q?SRsnShzIDa8+wf/DOigKZOmnKAteYYyhhq4kIXc77CcVqDk2N2xf8otr+LpA?=
 =?us-ascii?Q?dplQMwXhy2YTRsyfzHrSNL8HwD97sLWIIcfq5rlf3eLCvkdQyRFYTrvIMx8i?=
 =?us-ascii?Q?T4wJnw1hO4KgEHeJW4pwQU1J/+e8H7eouSwUUVke3LelrTnuXAYZChgd7J5j?=
 =?us-ascii?Q?dzcATO7xyj6NUiVypFBFNmJ654wqsrEgtBC4NZpOVzNDbwMTeiIPmOJIJDAS?=
 =?us-ascii?Q?tzeaXXOHxgyrRv325hLZDk0l?=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <BD14D07FA62D744DAAB7F276B5C2EA9F@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM6PR10MB4380.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6144b58c-5ea8-4b9b-85a4-08d977d0c165
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Sep 2021 22:41:12.9980
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: XhsgbE/g/FSxHCfL+S7RzSkAoS7J4GHfb/N5sfo65tpeEl8X1KxMJGXYedhWEFfxIGUeMKRnAHSrzuEV9vC82w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR10MB4281
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0
 adultscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001
 definitions=main-2109140130
X-Proofpoint-GUID: 5tLg38MzFuDpv98ARj5Pdo71E36w-hwA
X-Proofpoint-ORIG-GUID: 5tLg38MzFuDpv98ARj5Pdo71E36w-hwA
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Reviwed-by: Liam R. Howlett <Liam.Howlett@oracle.com>

* David Hildenbrand <david@redhat.com> [210909 12:23]:
> We should not walk/touch page tables outside of VMA boundaries when
> holding only the mmap sem in read mode. Evil user space can modify the
> VMA layout just before this function runs and e.g., trigger races with
> page table removal code since commit dd2283f2605e ("mm: mmap: zap pages
> with read mmap_sem in munmap").
>=20
> find_vma() does not check if the address is >=3D the VMA start address;
> use vma_lookup() instead.
>=20
> Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for pr=
otected KVM guests")
> Signed-off-by: David Hildenbrand <david@redhat.com>
> ---
>  arch/s390/kernel/uv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>=20
> diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
> index aeb0a15bcbb7..193205fb2777 100644
> --- a/arch/s390/kernel/uv.c
> +++ b/arch/s390/kernel/uv.c
> @@ -227,7 +227,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long=
 gaddr, void *uvcb)
>  	uaddr =3D __gmap_translate(gmap, gaddr);
>  	if (IS_ERR_VALUE(uaddr))
>  		goto out;
> -	vma =3D find_vma(gmap->mm, uaddr);
> +	vma =3D vma_lookup(gmap->mm, uaddr);
>  	if (!vma)
>  		goto out;
>  	/*
> --=20
> 2.31.1
>=20
> =