KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
Subsystems (2)
PATCH 1/1 KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
From: Dan Carpenter <[email protected]>
[ Upstream commit a25bc8486f9c01c1af6b6c5657234b2eee2c39d6 ]
The KVM_REG_SIZE() comes from the ioctl and it can be a power of two between 0-32768 but if it is more than sizeof(long) this will corrupt memory.
Fixes 99adb567632b ("KVM: arm/arm64: Add save/restore support for firmware workaround state")
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Steven Price <[email protected]>
Reviewed-by Eric Auger <[email protected]>
Reviewed-by Marc Zyngier <[email protected]>
Signed-off-by Oliver Upton <[email protected]>
Cc [email protected] # 5.10 and 5.15
[will: kvm_arm_set_fw_reg() lives in psci.c not hypercalls.c]
Signed-off-by Will Deacon <[email protected]>
--- arch/arm64/kvm/psci.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kvm/psci.c +2 -0
@@ -499,6 +499,8 @@ int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)u64 val;int wa_level; +if (KVM_REG_SIZE (reg->id) !=sizeof (val)) +return -ENOENT ;if (copy_from_user (&val, uaddr,KVM_REG_SIZE (reg->id)))return -EFAULT ;
Signature · 1 line
2.40.0.634.g4ca3ef3211-goog