title: KVM: s390: vsie: fix race during shadow creation
description: In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: fix race during shadow creation
Right now it is possible to see gmap->private being zero in
kvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the
fact that we add gmap->private == kvm after creation:
static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
struct vsie_page *vsie_page)
{
[...]
gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
if (IS_ERR(gmap))
return PTR_ERR(gmap);
gmap->private = vcpu->kvm;
Let children inherit the private field of the parent.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: a3508fbe9dc6, lessThan: 5df3b81a567e, status: affected, versionType: git
version: a3508fbe9dc6, lessThan: f5572c0323cf, status: affected, versionType: git
version: a3508fbe9dc6, lessThan: 28bb27824f25, status: affected, versionType: git
version: a3508fbe9dc6, lessThan: fe752331d4b3, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.8, status: affected
version: 0, lessThan: 4.8, status: unaffected, versionType: custom
version: 6.1.82, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.22, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.6, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
