diff options
| author | David Hildenbrand <dahi@linux.vnet.ibm.com> | 2015-02-04 15:59:11 +0100 |
|---|---|---|
| committer | Christian Borntraeger <borntraeger@de.ibm.com> | 2015-03-06 13:40:37 +0100 |
| commit | 15462e37ca848abac7477dece65f8af25febd744 (patch) | |
| tree | 3c1c0a7696fb9fc9775e1051ca683fd4349e851b /arch/s390/kvm/priv.c | |
| parent | 261520dcfcba93ca5dfe671b88ffab038cd940c8 (diff) | |
| download | linux-15462e37ca848abac7477dece65f8af25febd744.tar.bz2 | |
KVM: s390: reinjection of irqs can fail in the tpi handler
The reinjection of an I/O interrupt can fail if the list is at the limit
and between the dequeue and the reinjection, another I/O interrupt is
injected (e.g. if user space floods kvm with I/O interrupts).
This patch avoids this memory leak and returns -EFAULT in this special
case. This error is not recoverable, so let's fail hard. This can later
be avoided by not dequeuing the interrupt but working directly on the
locked list.
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org # 3.16+
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Diffstat (limited to 'arch/s390/kvm/priv.c')
| -rw-r--r-- | arch/s390/kvm/priv.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c index be7138e84351..b982fbca34df 100644 --- a/arch/s390/kvm/priv.c +++ b/arch/s390/kvm/priv.c @@ -279,7 +279,10 @@ reinject_interrupt: * instruction is suppressed from the guest's view: reinject the * interrupt. */ - kvm_s390_reinject_io_int(vcpu->kvm, inti); + if (kvm_s390_reinject_io_int(vcpu->kvm, inti)) { + kfree(inti); + rc = -EFAULT; + } /* don't set the cc, a pgm irq was injected or we drop to user space */ return rc ? -EFAULT : 0; } |