From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AC4EFA3728 for ; Wed, 16 Oct 2019 21:52:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 01C20218DE for ; Wed, 16 Oct 2019 21:52:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262746; bh=zia0u6U50VqyyHFrQCAoWOuBsAuMqjFRq80uvANzgHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nm4lJasF0rfitwp2CbHYIMDLhTs9Z6AfSFcOZqCn7mVgZ6kf0bnvnaHgJpbmdI3Ln 4jgEAmUhPrw1H6AYmVqJ1DC3hLTJCgOGAxqJnHlp0BHjVKF7xLXPtJRm7d3cwqT9TW uuM0JUaftDGV9c9wSq4RvVfZ77wCjjafOBjJMNJY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2394776AbfJPVwY (ORCPT ); Wed, 16 Oct 2019 17:52:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:41000 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2394721AbfJPVwY (ORCPT ); Wed, 16 Oct 2019 17:52:24 -0400 Received: from localhost (li1825-44.members.linode.com [172.104.248.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 514AD20872; Wed, 16 Oct 2019 21:52:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262742; bh=zia0u6U50VqyyHFrQCAoWOuBsAuMqjFRq80uvANzgHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DaUMULRyWVTXNrBHsOzETQgl0qnSwiAw0sbsbdmtC+NRYQT0bmZOwvYwds+MbfUSl 7tTLkzcctTOIHbG0dh/HCS0iEuQ6PqXZHei3JxF09jFZv9paprlE7FXhoinfu6zwIA vvMIKNd4Je1l2YPqXLgYgSwk04n/C8rzUXfNzMa8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Huth , Cornelia Huck , Janosch Frank , David Hildenbrand , Christian Borntraeger Subject: [PATCH 4.4 01/79] KVM: s390: Test for bad access register and size at the start of S390_MEM_OP Date: Wed, 16 Oct 2019 14:49:36 -0700 Message-Id: <20191016214730.169837508@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214729.758892904@linuxfoundation.org> References: <20191016214729.758892904@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Thomas Huth commit a13b03bbb4575b350b46090af4dfd30e735aaed1 upstream. If the KVM_S390_MEM_OP ioctl is called with an access register >= 16, then there is certainly a bug in the calling userspace application. We check for wrong access registers, but only if the vCPU was already in the access register mode before (i.e. the SIE block has recorded it). The check is also buried somewhere deep in the calling chain (in the function ar_translation()), so this is somewhat hard to find. It's better to always report an error to the userspace in case this field is set wrong, and it's safer in the KVM code if we block wrong values here early instead of relying on a check somewhere deep down the calling chain, so let's add another check to kvm_s390_guest_mem_op() directly. We also should check that the "size" is non-zero here (thanks to Janosch Frank for the hint!). If we do not check the size, we could call vmalloc() with this 0 value, and this will cause a kernel warning. Signed-off-by: Thomas Huth Link: https://lkml.kernel.org/r/20190829122517.31042-1-thuth@redhat.com Reviewed-by: Cornelia Huck Reviewed-by: Janosch Frank Reviewed-by: David Hildenbrand Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger Signed-off-by: Greg Kroah-Hartman --- arch/s390/kvm/kvm-s390.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -2471,7 +2471,7 @@ static long kvm_s390_guest_mem_op(struct const u64 supported_flags = KVM_S390_MEMOP_F_INJECT_EXCEPTION | KVM_S390_MEMOP_F_CHECK_ONLY; - if (mop->flags & ~supported_flags) + if (mop->flags & ~supported_flags || mop->ar >= NUM_ACRS || !mop->size) return -EINVAL; if (mop->size > MEM_OP_MAX_SIZE)