Patch "KVM: s390: vsie: fix race during shadow creation" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    KVM: s390: vsie: fix race during shadow creation

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kvm-s390-vsie-fix-race-during-shadow-creation.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit afbd9d3dd682500a4c3192ebc0da1abe2ae2697f
Author: Christian Borntraeger <borntraeger@xxxxxxxxxxxxx>
Date:   Wed Dec 20 13:53:17 2023 +0100

    KVM: s390: vsie: fix race during shadow creation
    
    [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ]
    
    Right now it is possible to see gmap->private being zero in
    kvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the
    fact that we add gmap->private == kvm after creation:
    
    static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
                                   struct vsie_page *vsie_page)
    {
    [...]
            gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
            if (IS_ERR(gmap))
                    return PTR_ERR(gmap);
            gmap->private = vcpu->kvm;
    
    Let children inherit the private field of the parent.
    
    Reported-by: Marc Hartmayer <mhartmay@xxxxxxxxxxxxx>
    Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
    Cc: <stable@xxxxxxxxxxxxxxx>
    Cc: David Hildenbrand <david@xxxxxxxxxx>
    Reviewed-by: Janosch Frank <frankja@xxxxxxxxxxxxx>
    Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
    Reviewed-by: Claudio Imbrenda <imbrenda@xxxxxxxxxxxxx>
    Signed-off-by: Christian Borntraeger <borntraeger@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 8207a892bbe22..db9a180de65f1 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1220,7 +1220,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
 	gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
 	if (IS_ERR(gmap))
 		return PTR_ERR(gmap);
-	gmap->private = vcpu->kvm;
 	vcpu->kvm->stat.gmap_shadow_create++;
 	WRITE_ONCE(vsie_page->gmap, gmap);
 	return 0;
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 20786f6883b29..157e0a8d5157d 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -1691,6 +1691,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce,
 		return ERR_PTR(-ENOMEM);
 	new->mm = parent->mm;
 	new->parent = gmap_get(parent);
+	new->private = parent->private;
 	new->orig_asce = asce;
 	new->edat_level = edat_level;
 	new->initialized = false;