Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 232a6462 authored by Matt Delco's avatar Matt Delco Committed by Greg Kroah-Hartman
Browse files

KVM: coalesced_mmio: add bounds checking 



commit b60fe990c6b07ef6d4df67bc0530c7c90a62623a upstream.

The first/last indexes are typically shared with a user app.
The app can change the 'last' index that the kernel uses
to store the next result.  This change sanity checks the index
before using it for writing to a potentially arbitrary address.

This fixes CVE-2019-14821.

Cc: stable@vger.kernel.org
Fixes: 5f94c174 ("KVM: Add coalesced MMIO support (common part)")
Signed-off-by: default avatarMatt Delco <delco@chromium.org>
Signed-off-by: default avatarJim Mattson <jmattson@google.com>
Reported-by: default avatar <syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com>
[Use READ_ONCE. - Paolo]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7a1bad56

virt/kvm/coalesced_mmio.c

+10 −7
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev, 
	return 1;

}



static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)

static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last)

{

	struct kvm_coalesced_mmio_ring *ring;

	unsigned avail;
@@ -52,7 +52,7 @@ static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev) 
	 * there is always one unused entry in the buffer

	 */

	ring = dev->kvm->coalesced_mmio_ring;

	avail = (ring->first - ring->last - 1) % KVM_COALESCED_MMIO_MAX;

	avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX;

	if (avail == 0) {

		/* full */

		return 0;
@@ -67,24 +67,27 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu, 
{

	struct kvm_coalesced_mmio_dev *dev = to_mmio(this);

	struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;

	__u32 insert;



	if (!coalesced_mmio_in_range(dev, addr, len))

		return -EOPNOTSUPP;



	spin_lock(&dev->kvm->ring_lock);



	if (!coalesced_mmio_has_room(dev)) {

	insert = READ_ONCE(ring->last);

	if (!coalesced_mmio_has_room(dev, insert) ||

	    insert >= KVM_COALESCED_MMIO_MAX) {

		spin_unlock(&dev->kvm->ring_lock);

		return -EOPNOTSUPP;

	}



	/* copy data in first free entry of the ring */



	ring->coalesced_mmio[ring->last].phys_addr = addr;

	ring->coalesced_mmio[ring->last].len = len;

	memcpy(ring->coalesced_mmio[ring->last].data, val, len);

	ring->coalesced_mmio[insert].phys_addr = addr;

	ring->coalesced_mmio[insert].len = len;

	memcpy(ring->coalesced_mmio[insert].data, val, len);

	smp_wmb();

	ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX;

	ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX;

	spin_unlock(&dev->kvm->ring_lock);

	return 0;

}