From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89A4AC433EF for ; Wed, 16 Mar 2022 15:39:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353704AbiCPPkr (ORCPT ); Wed, 16 Mar 2022 11:40:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37710 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352451AbiCPPkq (ORCPT ); Wed, 16 Mar 2022 11:40:46 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 336703204B for ; Wed, 16 Mar 2022 08:39:32 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id EB82C1476; Wed, 16 Mar 2022 08:39:31 -0700 (PDT) Received: from monolith.localdoman (unknown [172.31.20.19]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id F1A1B3F7D7; Wed, 16 Mar 2022 08:39:30 -0700 (PDT) Date: Wed, 16 Mar 2022 15:39:55 +0000 From: Alexandru Elisei To: Martin Radev Cc: kvm@vger.kernel.org, will@kernel.org, julien.thierry.kdev@gmail.com, andre.przywara@arm.com Subject: Re: [PATCH kvmtool 5/5] mmio: Sanitize addr and len Message-ID: References: <20220303231050.2146621-1-martin.b.radev@gmail.com> <20220303231050.2146621-6-martin.b.radev@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220303231050.2146621-6-martin.b.radev@gmail.com> Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Hi, On Fri, Mar 04, 2022 at 01:10:50AM +0200, Martin Radev wrote: > This patch verifies that adding the addr and length arguments > from an MMIO op do not overflow. This is necessary because the > arguments are controlled by the VM. The length may be set to > an arbitrary value by using the rep prefix. > > Signed-off-by: Martin Radev The patch looks correct to me: Reviewed-by: Alexandru Elisei Thanks, Alex > --- > mmio.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/mmio.c b/mmio.c > index a6dd3aa..5a114e9 100644 > --- a/mmio.c > +++ b/mmio.c > @@ -32,6 +32,10 @@ static struct mmio_mapping *mmio_search(struct rb_root *root, u64 addr, u64 len) > { > struct rb_int_node *node; > > + /* If len is zero or if there's an overflow, the MMIO op is invalid. */ > + if (addr + len <= addr) > + return NULL; > + > node = rb_int_search_range(root, addr, addr + len); > if (node == NULL) > return NULL; > -- > 2.25.1 >