kvm: Change offset in kvm_write_guest_offset_cached to unsigned (7a86dab8) · Commits · 戴 / test

Since the offset is added directly to the hva from the gfn_to_hva_cache, a negative offset could result in an out of bounds write. The existing BUG_ON only checks for addresses beyond the end of the gfn_to_hva_cache, not for addresses before the start of the gfn_to_hva_cache. Note that all current call sites have non-negative offsets. Fixes: ("kvm: Introduce kvm_write_guest_offset_cached()") Reported-by:

Cfir Cohen <cfir@google.com> Signed-off-by:

Jim Mattson <jmattson@google.com> Reviewed-by:

Cfir Cohen <cfir@google.com> Reviewed-by:

Peter Shier <pshier@google.com> Reviewed-by:

Krish Sadhukhan <krish.sadhukhan@oracle.com> Reviewed-by:

Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by:

Radim Krčmář <rkrcmar@redhat.com>

include/linux/kvm_host.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -695,7 +695,8 @@ int kvm_write_guest(struct kvm kvm, gpa_t gpa, const void data,
		int kvm_write_guest_cached(struct kvm kvm, struct gfn_to_hva_cache ghc,
		void *data, unsigned long len);
		int kvm_write_guest_offset_cached(struct kvm kvm, struct gfn_to_hva_cache ghc,
		void *data, int offset, unsigned long len);
		void *data, unsigned int offset,
		unsigned long len);
		int kvm_gfn_to_hva_cache_init(struct kvm kvm, struct gfn_to_hva_cache ghc,
		gpa_t gpa, unsigned long len);
		int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);

virt/kvm/kvm_main.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2043,7 +2043,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm kvm, struct gfn_to_hva_cache ghc,
		EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);

		int kvm_write_guest_offset_cached(struct kvm kvm, struct gfn_to_hva_cache ghc,
		void *data, int offset, unsigned long len)
		void *data, unsigned int offset,
		unsigned long len)
		{
		struct kvm_memslots *slots = kvm_memslots(kvm);
		int r;

Admin message