Files
linux/arch/s390/include/asm
Claudio Imbrenda 496e0f706b KVM: s390: Fix unlikely NULL gmap dereference
When creating a new vCPU, kvm_vm_ioctl_create_vcpu() will call
kvm_arch_vcpu_postcreate() after the file descriptor for the new vCPU
has been created. The new file descriptor has not been returned yet,
but a malicious userspace program could try to guess it.

If a malicious userspace program manages to start the newly created vCPU
before kvm_arch_vcpu_postcreate() is called, __vcpu_run() will try to
dereference vcpu->arch.gmap and trigger a NULL pointer dereference.

Fix this by adding a new field to struct kvm_vcpu_arch to keep track of
the initialization status of the vCPU. Refuse to run a vCPU that is not
fully initialized.

Fixes: dafd032a15 ("KVM: s390: move vcpu specific initalization to a later point")
Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260803124040.126471-2-imbrenda@linux.ibm.com>
2026-08-03 15:39:05 +02:00
..
2025-04-14 11:23:21 +02:00
2025-10-21 10:25:55 +02:00
2020-08-26 18:47:21 +02:00
2025-11-06 14:12:31 +01:00
2020-12-16 14:55:49 +01:00
2025-11-17 11:10:38 +01:00
2022-12-06 16:18:22 +01:00
2026-02-04 17:00:10 +01:00
2025-11-17 11:10:38 +01:00
2024-10-30 17:02:39 -07:00
2025-11-17 11:10:38 +01:00
2025-11-17 11:10:38 +01:00
2025-11-17 11:10:38 +01:00
2025-11-14 11:34:27 +01:00
2026-05-26 08:15:41 +02:00
2022-01-30 21:17:00 -05:00
2026-02-04 17:00:10 +01:00