Sean Christopherson
878127ac8b
KVM: Check validity of resolved slot when searching memslots ...
commit b6467ab142b708dd076f6186ca274f14af379c72 upstream.
Check that the resolved slot (somewhat confusingly named 'start') is a
valid/allocated slot before doing the final comparison to see if the
specified gfn resides in the associated slot. The resolved slot can be
invalid if the binary search loop terminated because the search index
was incremented beyond the number of used slots.
This bug has existed since the binary search algorithm was introduced,
but went unnoticed because KVM statically allocated memory for the max
number of slots, i.e. the access would only be truly out-of-bounds if
all possible slots were allocated and the specified gfn was less than
the base of the lowest memslot. Commit 36947254e5f98 ("KVM: Dynamically
size memslot array based on number of used slots") eliminated the "all
possible slots allocated" condition and made the bug embarrasingly easy
to hit.
Fixes: 9c1a5d3878syzbot+d889b59b2bb87d4047a2@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200408064059.8957-2-sean.j.christopherson@intel.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:33:16 +02:00
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
2020-01-14 20:08:28 +01:00
libceph: fix alloc_msg_with_page_vector() memory leaks
2020-04-02 15:11:02 +02:00
clk: add include guard to clk-conf.h
2019-09-17 10:27:46 -07:00
net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
2020-04-01 11:01:34 +02:00
Char/Misc driver patches for 5.4-rc1
2019-09-18 11:14:31 -07:00
gpio: add gpiod_toggle_active_low()
2020-02-19 19:53:09 +01:00
iio: core: remove extra semi-colon from devm_iio_device_register() macro
2020-04-29 16:33:12 +02:00
Merge branch 'next' into for-linus
2019-09-16 09:56:27 -07:00
mailbox: mediatek: cmdq: clear the event in cmdq initial flow
2019-09-17 00:40:05 -05:00
mfd: bd70528: Fix hour register mask
2020-02-11 04:35:52 -08:00
IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads
2020-04-13 10:48:10 +02:00
mmc: core: Allow host controllers to require R1B for CMD6
2020-04-01 11:01:27 +02:00
This pull-request contains the following changes for MTD:
2019-09-21 10:59:54 -07:00
netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports
2020-03-05 16:43:44 +01:00
bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
2020-02-24 08:36:35 +01:00
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
2020-02-01 09:34:49 +00:00
RDMA subsystem updates for 5.4
2019-09-21 10:26:24 -07:00
raid6/test: fix a compilation warning
2020-02-24 08:36:47 +01:00
regulator fix for "regulator: core: Add regulator_is_equal() helper"
2020-02-11 04:35:55 -08:00
timers/nohz: Update NOHZ load in remote tick
2020-03-05 16:43:36 +01:00
drm main pull for 5.4-rc1
2019-09-19 16:24:24 -07:00
SUNRPC: Destroy the back channel when we destroy the host transport
2019-10-30 12:04:35 -04:00
USB: core: add endpoint-blacklist quirk
2020-02-28 17:22:16 +01:00
ACPI: PM: Add acpi_[un]register_wakeup_handler()
2020-04-13 10:48:08 +02:00
ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
2020-01-09 10:19:59 +01:00
memcg: fix a crash in wb_workfn when a device disappears
2020-02-11 04:35:11 -08:00
block: add bio_truncate to fix guard_bio_eod
2020-01-09 10:19:54 +01:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
lib: introduce copy_struct_from_user() helper
2019-10-01 15:45:03 +02:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
2019-10-31 21:41:33 +01:00
ext4: use non-movable memory for superblock readahead
2020-04-23 10:36:15 +02:00
cgroup: Iterate tasks that did not finish do_exit()
2020-03-18 07:17:48 +01:00
Merge branches 'clk-init-destroy', 'clk-doc', 'clk-imx' and 'clk-allwinner' into clk-next
2019-09-19 15:31:27 -07:00
We have a small collection of core framework updates this time, mostly around
2019-09-20 15:45:07 -07:00
mm, compaction: raise compaction priority after it withdrawns
2019-09-24 15:54:10 -07:00
futex: Move futex exit handling into futex code
2019-11-29 10:10:08 +01:00
compiler.h: fix error in BUILD_BUG_ON() reporting
2020-04-23 10:36:37 +02:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
Make use of gcc 9's "asm inline()" (Rasmus Villemoes):
2019-09-21 09:47:19 -07:00
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
2020-04-17 10:50:11 +02:00
cpufreq: Avoid creating excessively large stack frames
2020-02-11 04:35:25 -08:00
padata: validate cpumask without removed CPU during offline
2020-02-24 08:36:34 +01:00
Power management updates for 5.4-rc1
2019-09-17 19:15:14 -07:00
cpumask: nicer for_each_cpumask_and() signature
2019-09-25 17:51:40 -07:00
selinux/stable-5.4 PR 20190917
2019-09-23 11:21:04 -07:00
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
2020-04-17 10:50:09 +02:00
USB changes for 5.4-rc1
2019-09-18 10:33:46 -07:00
dma-direct: check for overflows on 32 bit DMA addresses
2020-01-04 19:17:24 +01:00
dma-mapping: fix handling of dma-ranges for reserved memory (again)
2020-01-04 19:17:00 +01:00
dmaengine: Store module owner in dma_device struct
2020-02-24 08:36:40 +01:00
iommu/vt-d: Silence RCU-list debugging warnings
2020-04-01 11:01:53 +02:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
x86, efi: Never relocate kernel below lowest acceptable address
2019-10-31 09:40:19 +01:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
f2fs: Add a new CP flag to help fsck fix resize SPO issues
2020-04-23 10:36:33 +02:00
bpf: Fix use after free in subprog's jited symbol removal
2019-10-22 11:26:09 -07:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
fuse update for 5.4
2019-09-25 09:55:59 -07:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
HID: core: increase HID report buffer size to 8KiB
2020-03-05 16:43:42 +01:00
hrtimer: Annotate lockless access to timer->state
2020-01-04 19:18:41 +01:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS
2020-04-23 10:36:36 +02:00
hwmon: Fix HWMON_P_MIN_ALARM mask
2019-10-02 06:36:50 -07:00
- First round of vmbus hibernation support from Dexuan Cui.
2019-09-24 12:36:31 -07:00
Merge branch 'i2c/for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2019-09-24 16:48:02 -07:00
XArray updates for 5.4
2019-11-08 08:46:49 -08:00
ieee80211: fix HE SPR size calculation
2020-04-01 11:02:09 +02:00
macvlan: do not assume mac_header is set in macvlan_broadcast()
2020-01-12 12:21:46 +01:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
inet_diag: return classid for all socket types
2020-03-18 07:17:38 +01:00
iommu/vt-d: Fix debugfs register reads
2020-04-01 11:01:55 +02:00
iommu/vt-d: Fix compile warning from intel-svm.h
2020-02-28 17:22:26 +01:00
Power management updates for 5.4-rc1
2019-09-17 19:15:14 -07:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
block: Fix use-after-free issue accessing struct io_cq
2020-04-17 10:50:04 +02:00
iomap: move the iomap_dio_rw ->end_io callback into a structure
2019-09-19 15:32:45 -07:00
ipmi: Don't allow device module unload when in use
2019-12-31 16:44:14 +01:00
x86/apic/msi: Plug non-maskable MSI affinity race
2020-02-11 04:35:54 -08:00
genirq/irqdomain: Make sure all irq domain flags are distinct
2020-02-28 17:22:20 +01:00
jbd2: Fix possible overflow in jbd2_log_space_left()
2019-12-13 08:42:53 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:36:45 +02:00
kgdb: don't use a notifier to enter kgdb at panic; call directly
2019-09-25 17:51:40 -07:00
khugepaged: enable collapse pmd for pte-mapped THP
2019-09-24 15:54:11 -07:00
KVM: Check validity of resolved slot when searching memslots
2020-04-29 16:33:16 +02:00
x86/kvm: Cache gfn to pfn translation
2020-02-11 04:35:40 -08:00
leds: core: Fix leds.h structure documentation
2019-10-08 22:05:58 +02:00
ata: ahci: Add shutdown to freeze hardware resources of ahci
2020-02-28 17:22:28 +01:00
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
2020-01-04 19:18:28 +01:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
mm: fork: fix kernel_stack memcg stats for various stack implementations
2020-04-01 11:02:03 +02:00
mm/memory_hotplug: fix try_offline_node()
2019-11-15 18:34:00 -08:00
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
Revert "Revert "mm, thp: restore node-local hugepage allocations""
2019-09-28 14:05:38 -07:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: phy: fix write to mii-ctrl1000 register
2019-10-04 18:11:08 -07:00
rfkill: allocate static minor
2019-12-13 08:43:18 +01:00
mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
2020-03-12 13:00:19 +01:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
fork: improve error message for corrupted page tables
2019-09-25 17:51:40 -07:00
mm: memcg/slab: fix percpu slab vmstats flushing
2020-01-23 08:22:39 +01:00
mod_devicetable: fix PHY module format
2019-12-31 16:41:16 +01:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
net: export netdev_next_lower_dev_rcu()
2020-03-05 16:43:35 +01:00
NFS: Refactor nfs_instantiate() for dentry referencing callers
2019-09-20 15:15:24 -04:00
nvme-fc: Revert "add module to ops template to allow module references"
2020-04-17 10:50:10 +02:00
nvme: introduce "Command Aborted By host" status code
2019-12-31 16:44:40 +01:00
nvmem: core: fix nvmem_cell_write inline function
2019-12-31 16:44:43 +01:00
crypto: pcrypt - Avoid deadlock by using per-instance padata queues
2020-02-11 04:35:28 -08:00
page-flags: fix a crash at SetPageError(THP_SWAP)
2020-03-25 08:25:58 +01:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
PCI: endpoint: Fix for concurrent memory allocation in OB address region
2020-04-17 10:50:11 +02:00
PCI: Add nr_devfns parameter to pci_add_dma_alias()
2020-02-24 08:36:37 +01:00
pci-v5.4-changes
2019-09-23 19:16:01 -07:00
percpu: Separate decrypted varaibles anytime encryption can be enabled
2020-02-11 04:35:44 -08:00
percpu_counter: fix a data race at vm_committed_as
2020-04-23 10:36:37 +02:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
net: phy: fix MDIO bus PM PHY resuming
2020-03-18 07:17:46 +01:00
driver code: clarify and fix platform device DMA mask allocation
2020-03-18 07:17:56 +01:00
PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
2019-12-21 11:04:31 +01:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds
2019-09-25 17:51:39 -07:00
pwm: Ensure pwm_apply_state() doesn't modify the state argument
2019-09-21 03:25:10 +02:00
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 19:17:25 +01:00
quota: Check that quota is not dirty before release
2019-12-17 19:56:43 +01:00
radix tree: Remove radix_tree_iter_find
2019-11-01 22:26:34 -04:00
augmented rbtree: rework the RB_DECLARE_CALLBACKS macro definition
2019-09-25 17:51:39 -07:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-16 17:25:49 -07:00
tasks, sched/core: With a grace period after finish_task_switch(), remove unnecessary code
2019-09-25 17:42:29 +02:00
reset: fix reset_control_ops kerneldoc comment
2019-10-28 12:18:23 +01:00
reset: fix reset_control_get_exclusive kerneldoc comment
2019-10-24 10:26:33 +02:00
cifs: Add support for root file systems
2019-09-16 11:43:38 -05:00
signal: Extend exec_id to 64bits
2020-04-17 10:50:12 +02:00
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-31 09:40:21 +01:00
vt: selection, introduce vc_is_sel
2020-04-02 15:11:00 +02:00
mm: shrinker: make shrinker not depend on memcg kmem
2019-09-24 15:54:11 -07:00
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
2020-04-01 11:02:18 +02:00
bpf: Sockmap/tls, push write_space updates through ulp updates
2020-01-23 08:22:45 +01:00
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
lib/string: Make memzero_explicit() inline instead of external
2019-10-08 13:27:05 +02:00
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
2020-02-19 19:52:56 +01:00
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
mm: introduce MADV_PAGEOUT
2019-09-25 17:51:41 -07:00
include/linux/swapops.h: correct guards for non_swap_entry()
2020-04-23 10:36:37 +02:00
sysfs: Fixes __BIN_ATTR_WO() macro
2019-10-02 10:06:45 +02:00
block: centralize PI remapping logic to the block layer
2019-09-17 20:03:49 -06:00
tcp: add rcu protection around tp->fastopen_rsk
2019-10-13 10:13:08 -07:00
uaccess: disallow > INT_MAX copy sizes
2020-01-04 19:18:42 +01:00
tcp: fix rejected syncookies due to stale timestamps
2019-12-18 16:08:43 +01:00
bpf: Fix incorrect verifier simulation of ARSH under ALU32
2020-01-23 08:22:44 +01:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-16 17:25:49 -07:00
efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing
2019-10-07 15:24:36 +02:00
serdev: ttyport: restore client ops on deregistration
2020-02-28 17:22:19 +01:00
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt'
2019-10-28 04:25:04 -04:00
vmalloc: fix remap_vmalloc_range() bounds checks
2020-04-29 16:33:14 +02:00
vt: switch vt_dont_switch to bool
2020-04-02 15:11:00 +02:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-17 12:35:15 -07:00
xarray: Fix early termination of xas_for_each_marked
2020-04-17 10:50:18 +02:00
zpool: add malloc_support_movable to zpool_driver
2019-09-24 15:54:12 -07:00
