mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-16 04:04:06 +00:00
KVM: Disallow user memslot with size that exceeds "unsigned long"
commit6b285a5587
upstream. Reject userspace memslots whose size exceeds the storage capacity of an "unsigned long". KVM's uAPI takes the size as u64 to support large slots on 64-bit hosts, but does not account for the size being truncated on 32-bit hosts in various flows. The access_ok() check on the userspace virtual address in particular casts the size to "unsigned long" and will check the wrong number of bytes. KVM doesn't actually support slots whose size doesn't fit in an "unsigned long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long", not a "u64", and misc arch specific code follows that behavior. Fixes:fa3d315a4c
("KVM: Validate userspace_addr of memslot when registered") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Message-Id: <20211104002531.1176691-3-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
3c4dd49641
commit
21bec94622
1 changed files with 2 additions and 1 deletions
|
@ -1664,7 +1664,8 @@ int __kvm_set_memory_region(struct kvm *kvm,
|
|||
id = (u16)mem->slot;
|
||||
|
||||
/* General sanity checks */
|
||||
if (mem->memory_size & (PAGE_SIZE - 1))
|
||||
if ((mem->memory_size & (PAGE_SIZE - 1)) ||
|
||||
(mem->memory_size != (unsigned long)mem->memory_size))
|
||||
return -EINVAL;
|
||||
if (mem->guest_phys_addr & (PAGE_SIZE - 1))
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Add table
Reference in a new issue