Commit d1505b5c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'powerpc-6.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux 

Pull powerpc fixes from Michael Ellerman:

 - Prevent use-after-free in 64-bit KVM VFIO

 - Add generated Power8 crypto asm to .gitignore

Thanks to Al Viro and Nathan Lynch.

* tag 'powerpc-6.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
  powerpc/crypto: Add generated P8 asm to .gitignore
parents 5f583a31 a986fa57

arch/powerpc/crypto/.gitignore

+2 −0
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0-only

aesp10-ppc.S

aesp8-ppc.S

ghashp10-ppc.S

ghashp8-ppc.S

arch/powerpc/kvm/book3s_64_vio.c

+13 −5
Original line number Diff line number Diff line
@@ -130,14 +130,16 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
	}

	rcu_read_unlock();



	if (!found) {

		fdput(f);



	if (!found)

		return -EINVAL;

	}



	table_group = iommu_group_get_iommudata(grp);

	if (WARN_ON(!table_group))

	if (WARN_ON(!table_group)) {

		fdput(f);

		return -EFAULT;

	}



	for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {

		struct iommu_table *tbltmp = table_group->tables[i];
@@ -158,8 +160,10 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
			break;

		}

	}

	if (!tbl)

	if (!tbl) {

		fdput(f);

		return -EINVAL;

	}



	rcu_read_lock();

	list_for_each_entry_rcu(stit, &stt->iommu_tables, next) {
@@ -170,6 +174,7 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
			/* stit is being destroyed */

			iommu_tce_table_put(tbl);

			rcu_read_unlock();

			fdput(f);

			return -ENOTTY;

		}

		/*
@@ -177,6 +182,7 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
		 * its KVM reference counter and can return.

		 */

		rcu_read_unlock();

		fdput(f);

		return 0;

	}

	rcu_read_unlock();
@@ -184,6 +190,7 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
	stit = kzalloc(sizeof(*stit), GFP_KERNEL);

	if (!stit) {

		iommu_tce_table_put(tbl);

		fdput(f);

		return -ENOMEM;

	}
@@ -192,6 +199,7 @@ long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 


	list_add_rcu(&stit->next, &stt->iommu_tables);



	fdput(f);

	return 0;

}