diff options
| author | Matt Delco <delco@chromium.org> | 2019-09-16 14:16:54 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-09-21 07:12:47 +0200 |
| commit | ae41539657ce0a4e9f4588e89e5e19a8b8f11928 (patch) | |
| tree | a0f77a1180d0b6e714c5690c9eee4829f87f6687 /samples/kdb | |
| parent | ac591429f94c43113dee9cc42ff69305a43365eb (diff) | |
| download | linux-stable-ae41539657ce0a4e9f4588e89e5e19a8b8f11928.tar.gz linux-stable-ae41539657ce0a4e9f4588e89e5e19a8b8f11928.tar.bz2 linux-stable-ae41539657ce0a4e9f4588e89e5e19a8b8f11928.zip | |
KVM: coalesced_mmio: add bounds checking
commit b60fe990c6b07ef6d4df67bc0530c7c90a62623a upstream.
The first/last indexes are typically shared with a user app.
The app can change the 'last' index that the kernel uses
to store the next result. This change sanity checks the index
before using it for writing to a potentially arbitrary address.
This fixes CVE-2019-14821.
Cc: stable@vger.kernel.org
Fixes: 5f94c1741bdc ("KVM: Add coalesced MMIO support (common part)")
Signed-off-by: Matt Delco <delco@chromium.org>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reported-by: syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com
[Use READ_ONCE. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'samples/kdb')
0 files changed, 0 insertions, 0 deletions