Go to file
Sean Christopherson 6a44f200f1 KVM: Disallow user memslot with size that exceeds "unsigned long"
commit 6b285a5587506bae084cf9a3ed5aa491d623b91b upstream.

Reject userspace memslots whose size exceeds the storage capacity of an
"unsigned long".  KVM's uAPI takes the size as u64 to support large slots
on 64-bit hosts, but does not account for the size being truncated on
32-bit hosts in various flows.  The access_ok() check on the userspace
virtual address in particular casts the size to "unsigned long" and will
check the wrong number of bytes.

KVM doesn't actually support slots whose size doesn't fit in an "unsigned
long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long",
not a "u64", and misc arch specific code follows that behavior.

Fixes: fa3d315a4c ("KVM: Validate userspace_addr of memslot when registered")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-Id: <20211104002531.1176691-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 09:03:21 +01:00
arch s390/pci: move pseudo-MMIO to prevent MIO overlap 2021-12-08 09:03:21 +01:00
block block: Check ADMIN before NICE for IOPRIO_CLASS_RT 2021-11-26 10:39:19 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:50:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-18 14:04:12 +01:00
Documentation netfilter: ipvs: Fix reuse connection if RS weight is 0 2021-12-01 09:19:02 +01:00
drivers drm/amd/display: Allow DSC on supported MST branch devices 2021-12-08 09:03:21 +01:00
fs fget: check that the fd still exists after getting a ref to it 2021-12-08 09:03:21 +01:00
include ipv6: fix memory leak in fib6_rule_suppress 2021-12-08 09:03:21 +01:00
init bootconfig: init: Fix memblock leak in xbc_make_cmdline() 2021-11-21 13:46:35 +01:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:19:10 +01:00
kernel kprobes: Limit max data_size of the kretprobe instances 2021-12-08 09:03:20 +01:00
lib lib/xz: Validate the value before assigning it to an enum variable 2021-11-18 14:03:58 +01:00
LICENSES LICENSES/deprecated: add Zlib license text 2020-09-16 14:33:49 +02:00
mm hugetlbfs: flush TLBs correctly after huge_pmd_unshare 2021-11-26 10:39:21 +01:00
net ipv6: fix memory leak in fib6_rule_suppress 2021-12-08 09:03:21 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-18 14:04:11 +01:00
scripts scripts/lld-version.sh: Rewrite based on upstream ld-version.sh 2021-11-21 13:46:37 +01:00
security selinux: fix NULL-pointer dereference when hashtab allocation fails 2021-11-26 10:39:21 +01:00
sound ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec 2021-12-01 09:19:04 +01:00
tools perf report: Fix memory leaks around perf_tip() 2021-12-08 09:03:20 +01:00
usr Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 13:29:39 -07:00
virt KVM: Disallow user memslot with size that exceeds "unsigned long" 2021-12-08 09:03:21 +01:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore kbuild: generate Module.symvers only when vmlinux exists 2021-05-19 10:12:59 +02:00
.mailmap mailmap: add two more addresses of Uwe Kleine-König 2020-12-06 10:19:07 -08:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Jason Cooper to CREDITS 2020-11-30 10:20:34 +01:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS f2fs: move ioctl interface definitions to separated file 2021-05-19 10:13:00 +02:00
Makefile Linux 5.10.83 2021-12-01 09:19:10 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.