kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/virt/kvm/arm
History
Marc Zyngier 8f1a2803e4 KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list 
commit 7d8b44c54e upstream.

vgic_copy_lpi_list() parses the LPI list and picks LPIs targeting
a given vcpu. We allocate the array containing the intids before taking
the lpi_list_lock, which means we can have an array size that is not
equal to the number of LPIs.

This is particularly obvious when looking at the path coming from
vgic_enable_lpis, which is not a command, and thus can run in parallel
with commands:

vcpu 0:                                        vcpu 1:
vgic_enable_lpis
  its_sync_lpi_pending_table
    vgic_copy_lpi_list
      intids = kmalloc_array(irq_count)
                                               MAPI(lpi targeting vcpu 0)
      list_for_each_entry(lpi_list_head)
        intids[i++] = irq->intid;

At that stage, we will happily overrun the intids array. Boo. An easy
fix is is to break once the array is full. The MAPI command will update
the config anyway, and we won't miss a thing. We also make sure that
lpi_list_count is read exactly once, so that further updates of that
value will not affect the array bound check.

Cc: stable@vger.kernel.org
Fixes: ccb1d791ab ("KVM: arm64: vgic-its: Fix pending table sync")
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2018-04-24 09:36:23 +02:00
..
hyp kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3 2018-03-21 12:06:43 +01:00
vgic KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list 2018-04-24 09:36:23 +02:00
aarch32.c KVM: arm64: Make kvm_condition_valid32() accessible from EL2 2017-06-15 09:44:58 +01:00
arch_timer.c KVM: arm/arm64: Reduce verbosity of KVM init log 2018-03-21 12:06:43 +01:00
arm.c kvm: arm: don't treat unavailable HYP mode as an error 2018-02-25 11:07:55 +01:00
mmio.c KVM: Fix stack-out-of-bounds read in write_mmio 2018-01-17 09:45:17 +01:00
mmu.c KVM: arm/arm64: Reduce verbosity of KVM init log 2018-03-21 12:06:43 +01:00
perf.c KVM: arm/arm64: Move shared files to virt/kvm/arm 2017-05-04 13:57:26 +02:00
pmu.c KVM: arm/arm64: PMU: Fix overflow interrupt injection 2017-07-25 14:18:01 +01:00
psci.c arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support 2018-02-16 20:22:55 +01:00
trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00