Messages in this thread | | | From | Thomas Gleixner <> | Subject | Re: [PATCH 16/19] kvm: x86: Introduce KVM_{G|S}ET_XSAVE2 ioctl | Date | Mon, 13 Dec 2021 13:40:28 +0100 |
| |
On Mon, Dec 13 2021 at 11:43, Paolo Bonzini wrote: > On 12/13/21 11:10, Thomas Gleixner wrote: >> On Fri, Dec 10 2021 at 17:30, Paolo Bonzini wrote: >>> I think fpu_copy_uabi_to_guest_fpstate (and therefore >>> copy_uabi_from_kernel_to_xstate) needs to check that the size is >>> compatible with the components in the input. >> >> fpu_copy_uabi_to_guest_fpstate() expects that the input buffer is >> correctly sized. We surely can add a size check there. > > fpu_copy_guest_fpstate_to_uabi is more problematic because that one > writes memory. For fpu_copy_uabi_to_guest_fpstate, we know the input > buffer size from the components and we can use it to do a properly-sized > memdup_user. > > For fpu_copy_guest_fpstate_to_uabi we can just decide that KVM_GET_XSAVE > will only save up to the first 4K. Something like the following might > actually be good for 5.16-rc; right now, header.xfeatures might lead > userspace into reading uninitialized or unmapped memory:
If user space supplies a 4k buffer and reads beyond the end of the buffer then it's hardly a kernel problem.
That function allows to provide a short buffer and fill it up to the point where the buffer ends with the real information.
Thanks,
tglx
| |