KVM: PPC: Book3S HV: Read kvm->arch.emul_smt_mode under kvm->lock

Commit 1e175d2 ("KVM: PPC: Book3S HV: Pack VCORE IDs to access full
VCPU ID space", 2018-07-25) added code that uses kvm->arch.emul_smt_mode
before any VCPUs are created.  However, userspace can change
kvm->arch.emul_smt_mode at any time up until the first VCPU is created.
Hence it is (theoretically) possible for the check in
kvmppc_core_vcpu_create_hv() to race with another userspace thread
changing kvm->arch.emul_smt_mode.

This fixes it by moving the test that uses kvm->arch.emul_smt_mode into
the block where kvm->lock is held.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 785245e..113f815 100644 (file)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1989,16 +1989,10 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,
                                                   unsigned int id)
 {
        struct kvm_vcpu *vcpu;
-       int err = -EINVAL;
+       int err;
        int core;
        struct kvmppc_vcore *vcore;
 
-       if (id >= (KVM_MAX_VCPUS * kvm->arch.emul_smt_mode) &&
-           cpu_has_feature(CPU_FTR_ARCH_300)) {
-               pr_devel("DNCI: VCPU ID too high\n");
-               goto out;
-       }
-
        err = -ENOMEM;
        vcpu = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
        if (!vcpu)
@@ -2055,8 +2049,13 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,
        vcore = NULL;
        err = -EINVAL;
        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
-               BUG_ON(kvm->arch.smt_mode != 1);
-               core = kvmppc_pack_vcpu_id(kvm, id);
+               if (id >= (KVM_MAX_VCPUS * kvm->arch.emul_smt_mode)) {
+                       pr_devel("KVM: VCPU ID too high\n");
+                       core = KVM_MAX_VCORES;
+               } else {
+                       BUG_ON(kvm->arch.smt_mode != 1);
+                       core = kvmppc_pack_vcpu_id(kvm, id);
+               }
        } else {
                core = id / kvm->arch.smt_mode;
        }