From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69E96C43381 for ; Fri, 22 Mar 2019 11:30:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 38DBE218B0 for ; Fri, 22 Mar 2019 11:30:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553254212; bh=3bGhywEGhiChXQyWHIibE+Wj8YlRtUwJa21gefGreGc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OEAOt9PJD80dLpU21zHlJV8VJppNN+b1cfgQlRLGJjdIBRYrth3LLgiGAww2tHVSS y+CqFd/okN8GKqB4pKojbCZ1Gj+G2EsjRzUwVWEMBMbCQwoLYF+9vfeSs/YtvwJRBx j6SdSyWIOqP5DzdxM/Gy2a9xhBEz40Y+0hPM/Y9Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729917AbfCVLaK (ORCPT ); Fri, 22 Mar 2019 07:30:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:58078 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729888AbfCVLaI (ORCPT ); Fri, 22 Mar 2019 07:30:08 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 69EF520449; Fri, 22 Mar 2019 11:30:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553254207; bh=3bGhywEGhiChXQyWHIibE+Wj8YlRtUwJa21gefGreGc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZaUfERBe8bsTwoomCv9GAetsBAr4GWykwVZSx93drUZexsvbFf5J4WtNWKWHqhF+j lXONWg2zufmaOkK5COqA3KFa2bdisJJE7m2mzqcmlKNQr9cLaUa4XzF4OjVXsdJrRG HCYDufeiRpWfStvHIt2M8acWlzV/ApzsQm1kPzJ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoffer Dall , Marc Zyngier Subject: [PATCH 4.4 049/230] arm/arm64: KVM: Feed initialized memory to MMIO accesses Date: Fri, 22 Mar 2019 12:13:07 +0100 Message-Id: <20190322111240.146468386@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111236.796964179@linuxfoundation.org> References: <20190322111236.796964179@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Marc Zyngier commit 1d6a821277aaa0cdd666278aaff93298df313d41 upstream. On an MMIO access, we always copy the on-stack buffer info the shared "run" structure, even if this is a read access. This ends up leaking up to 8 bytes of uninitialized memory into userspace, depending on the size of the access. An obvious fix for this one is to only perform the copy if this is an actual write. Reviewed-by: Christoffer Dall Signed-off-by: Marc Zyngier Signed-off-by: Greg Kroah-Hartman --- arch/arm/kvm/mmio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/arm/kvm/mmio.c +++ b/arch/arm/kvm/mmio.c @@ -207,7 +207,8 @@ int io_mem_abort(struct kvm_vcpu *vcpu, run->mmio.is_write = is_write; run->mmio.phys_addr = fault_ipa; run->mmio.len = len; - memcpy(run->mmio.data, data_buf, len); + if (is_write) + memcpy(run->mmio.data, data_buf, len); if (!ret) { /* We handled the access successfully in the kernel. */