Sean Christopherson 0827b8db5c KVM: Disallow user memslot with size that exceeds "unsigned long" ... commit 6b285a5587 upstream. Reject userspace memslots whose size exceeds the storage capacity of an "unsigned long". KVM's uAPI takes the size as u64 to support large slots on 64-bit hosts, but does not account for the size being truncated on 32-bit hosts in various flows. The access_ok() check on the userspace virtual address in particular casts the size to "unsigned long" and will check the wrong number of bytes. KVM doesn't actually support slots whose size doesn't fit in an "unsigned long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long", not a "u64", and misc arch specific code follows that behavior. Fixes: fa3d315a4c ("KVM: Validate userspace_addr of memslot when registered") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Message-Id: <20211104002531.1176691-3-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-08 09:04:43 +01:00
..
async_pf.c	mm/gup: remove task_struct pointer for all gup code	2020-08-12 10:58:04 -07:00
async_pf.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504	2019-06-19 17:09:56 +02:00
binary_stats.c	KVM: stats: remove dead stores	2021-08-13 03:35:15 -04:00
coalesced_mmio.c	KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio	2021-07-14 12:17:56 -04:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dirty_ring.c	KVM: Drop unused kvm_dirty_gfn_invalid()	2021-09-06 08:23:46 -04:00
eventfd.c	kvm/eventfd: Drain events from eventfd in irqfd_wakeup()	2020-11-15 09:49:11 -05:00
irqchip.c	KVM/arm updates for 5.3	2019-07-11 15:14:16 +02:00
Kconfig	kvm: add PM-notifier	2021-06-17 13:09:32 -04:00
kvm_main.c	KVM: Disallow user memslot with size that exceeds "unsigned long"	2021-12-08 09:04:43 +01:00
mmu_lock.h	KVM: x86/mmu: Use an rwlock for the x86 MMU	2021-02-04 05:27:43 -05:00
vfio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00