hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix a host crash triggerable by the guest via a channel program. 

-----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEw9DWbcNiT/aowBjO3s9rk8bwL68FAlyGipcSHGNvaHVja0By
 ZWRoYXQuY29tAAoJEN7Pa5PG8C+v+moP/2JK1vNI4OY4Jl0djOJabgbbBM9a8RcN
 2jcrecMOfcssZNAffPc5JfN0pDQ2e8eTAn4khSdwkG0H+N7XfYdKm9ZCwnXh1YAj
 mEmE6hvGsH2xEGnXZgyj9F3a9Uovpnxeit/ZgsO8JR+7pq3eHolgsLLOI4MwaUTz
 PNyOqkG5t220EVVGZRREGeChVMhIEldtCBqnPGM1dzPfxoCQMPT1fECyLThiH+JC
 WjjoRs6BZuusPKOa+6lNwiXYNWf+va6Xiebx0XL9Mepf0v8zGZzf9rKGSkDCZP8L
 D9NSx7bSVLc+M8lPOEhIbwQQmCAOEpu/B+ERndVDJhp+eKkqpN5BfnCPdtZYpWjg
 kAZIwBQYB3pDdFhsavd8IjW/FA+Bgrfz9XZDzO4oOhoaTYXc1UfdulWWT6KE6hXO
 5hzb6AuUM0xVR8VnCnI+jeMyBPUbYeZ49TTFBV1oZYLvVHiFBaBISs/zyzvniU3E
 gYJdrXkx5PpX4zd/YUouYdq6xiilyg8a/TVgjykLWBj9wLhT2z6oP3LfDoPb1dt2
 nvry6jptUJCqbd7a821zq/2DxneWzVpNjT8LjFJouKEe69VAB5Rml1zy4E9CrXdJ
 Q3AGsiSya066tan+9QE1tBbxrTpMvkWdIY9kb00XLUjI9VotKAbicEqjIqCvcJHb
 9TkG9M6zH1Ig
 =ko62
 -----END PGP SIGNATURE-----

Merge tag 'vfio-ccw-20190311' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into fixes

Pull vfio-ccw from Cornelia Huck with the following changes:

 - Fix a host crash triggerable by the guest via a channel program.
This commit is contained in:
Martin Schwidefsky 2019-03-11 10:10:39 -07:00
parent 152e9b8676 50b7f1b723
commit 0ba8141fa0
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/s390/cio/vfio_ccw_drv.c
View File

@ -72,20 +72,24 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
{
struct vfio_ccw_private *private;
struct irb *irb;
bool is_final;
private = container_of(work, struct vfio_ccw_private, io_work);
irb = &private->irb;
is_final = !(scsw_actl(&irb->scsw) &
(SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
if (scsw_is_solicited(&irb->scsw)) {
cp_update_scsw(&private->cp, &irb->scsw);
cp_free(&private->cp);
if (is_final)
cp_free(&private->cp);
}
memcpy(private->io_region->irb_area, irb, sizeof(*irb));
if (private->io_trigger)
eventfd_signal(private->io_trigger, 1);
if (private->mdev)
if (private->mdev && is_final)
private->state = VFIO_CCW_STATE_IDLE;
}