Linux-HyperV Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva_list()
@ 2019-09-02 12:41 lantianyu1986
  2019-09-02 14:40 ` Michael Kelley
  0 siblings, 1 reply; 2+ messages in thread
From: lantianyu1986 @ 2019-09-02 12:41 UTC (permalink / raw)
  To: kys, haiyangz, sthemmin, sashal, tglx, mingo, bp, hpa, x86,
	alex.williamson, cohuck, michael.h.kelley
  Cc: Tianyu Lan, linux-hyperv, linux-kernel, kvm

From: Tianyu Lan <Tianyu.Lan@microsoft.com>

When the 'start' parameter is >=  0xFF000000 on 32-bit
systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems,
fill_gva_list gets into an infinite loop.  With such inputs,
'cur' overflows after adding HV_TLB_FLUSH_UNIT and always
compares as less than end.  Memory is filled with guest virtual
addresses until the system crashes

Fix this by never incrementing 'cur' to be larger than 'end'.

Reported-by: Jong Hyun Park <park.jonghyun@yonsei.ac.kr>
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Fixes: 2ffd9e33ce4a ("x86/hyper-v: Use hypercall for remote TLB flush")
---
Change since v1:
     - Simply the commit message 

 arch/x86/hyperv/mmu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
index e65d7fe6489f..5208ba49c89a 100644
--- a/arch/x86/hyperv/mmu.c
+++ b/arch/x86/hyperv/mmu.c
@@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
 		 * Lower 12 bits encode the number of additional
 		 * pages to flush (in addition to the 'cur' page).
 		 */
-		if (diff >= HV_TLB_FLUSH_UNIT)
+		if (diff >= HV_TLB_FLUSH_UNIT) {
 			gva_list[gva_n] |= ~PAGE_MASK;
-		else if (diff)
+			cur += HV_TLB_FLUSH_UNIT;
+		}  else if (diff) {
 			gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
+			cur = end;
+		}
 
-		cur += HV_TLB_FLUSH_UNIT;
 		gva_n++;
 
 	} while (cur < end);
-- 
2.14.5


^ permalink raw reply	[flat|nested] 2+ messages in thread

* RE: [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva_list()
  2019-09-02 12:41 [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva_list() lantianyu1986
@ 2019-09-02 14:40 ` Michael Kelley
  0 siblings, 0 replies; 2+ messages in thread
From: Michael Kelley @ 2019-09-02 14:40 UTC (permalink / raw)
  To: lantianyu1986, KY Srinivasan, Haiyang Zhang, Stephen Hemminger,
	sashal, tglx, mingo, bp, hpa, x86, alex.williamson, cohuck
  Cc: Tianyu Lan, linux-hyperv, linux-kernel, kvm

From: Tianyu Lan <Tianyu.Lan@microsoft.com> Sent: Monday, September 2, 2019 5:42 AM
> 
> When the 'start' parameter is >=  0xFF000000 on 32-bit
> systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems,
> fill_gva_list gets into an infinite loop.  With such inputs,
> 'cur' overflows after adding HV_TLB_FLUSH_UNIT and always
> compares as less than end.  Memory is filled with guest virtual
> addresses until the system crashes
> 
> Fix this by never incrementing 'cur' to be larger than 'end'.
> 
> Reported-by: Jong Hyun Park <park.jonghyun@yonsei.ac.kr>
> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
> Fixes: 2ffd9e33ce4a ("x86/hyper-v: Use hypercall for remote TLB flush")
> ---
> Change since v1:
>      - Simply the commit message
> 
>  arch/x86/hyperv/mmu.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
> index e65d7fe6489f..5208ba49c89a 100644
> --- a/arch/x86/hyperv/mmu.c
> +++ b/arch/x86/hyperv/mmu.c
> @@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
>  		 * Lower 12 bits encode the number of additional
>  		 * pages to flush (in addition to the 'cur' page).
>  		 */
> -		if (diff >= HV_TLB_FLUSH_UNIT)
> +		if (diff >= HV_TLB_FLUSH_UNIT) {
>  			gva_list[gva_n] |= ~PAGE_MASK;
> -		else if (diff)
> +			cur += HV_TLB_FLUSH_UNIT;
> +		}  else if (diff) {
>  			gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
> +			cur = end;
> +		}
> 
> -		cur += HV_TLB_FLUSH_UNIT;
>  		gva_n++;
> 
>  	} while (cur < end);
> --
> 2.14.5

Reviewed-by: Michael Kelley <mikelley@microsoft.com>


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-02 12:41 [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva_list() lantianyu1986
2019-09-02 14:40 ` Michael Kelley

Linux-HyperV Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-hyperv/0 linux-hyperv/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-hyperv linux-hyperv/ https://lore.kernel.org/linux-hyperv \
		linux-hyperv@vger.kernel.org linux-hyperv@archiver.kernel.org
	public-inbox-index linux-hyperv


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-hyperv


AGPL code for this site: git clone https://public-inbox.org/ public-inbox