lkml.org 
[lkml]   [2018]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.9 215/293] kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
    Date
    From: Paolo Bonzini <pbonzini@redhat.com>

    [ Upstream commit 51776043afa415435c7e4636204fbe4f7edc4501 ]

    This ioctl is obsolete (it was used by Xenner as far as I know) but
    still let's not break it gratuitously... Its handler is copying
    directly into struct kvm. Go through a bounce buffer instead, with
    the added benefit that we can actually do something useful with the
    flags argument---the previous code was exiting with -EINVAL but still
    doing the copy.

    This technically is a userspace ABI breakage, but since no one should be
    using the ioctl, it's a good occasion to see if someone actually
    complains.

    Cc: kernel-hardening@lists.openwall.com
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    arch/x86/kvm/x86.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 3aaaf305420d..803bb452aac6 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -4130,13 +4130,14 @@ long kvm_arch_vm_ioctl(struct file *filp,
    mutex_unlock(&kvm->lock);
    break;
    case KVM_XEN_HVM_CONFIG: {
    + struct kvm_xen_hvm_config xhc;
    r = -EFAULT;
    - if (copy_from_user(&kvm->arch.xen_hvm_config, argp,
    - sizeof(struct kvm_xen_hvm_config)))
    + if (copy_from_user(&xhc, argp, sizeof(xhc)))
    goto out;
    r = -EINVAL;
    - if (kvm->arch.xen_hvm_config.flags)
    + if (xhc.flags)
    goto out;
    + memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc));
    r = 0;
    break;
    }
    --
    2.15.1
    \
     
     \ /
      Last update: 2018-04-09 03:58    [W:3.870 / U:0.620 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site