Matt Delco ae41539657 KVM: coalesced_mmio: add bounds checking ... commit b60fe990c6b07ef6d4df67bc0530c7c90a62623a upstream. The first/last indexes are typically shared with a user app. The app can change the 'last' index that the kernel uses to store the next result. This change sanity checks the index before using it for writing to a potentially arbitrary address. This fixes CVE-2019-14821. Cc: stable@vger.kernel.org Fixes: 5f94c1741b ("KVM: Add coalesced MMIO support (common part)") Signed-off-by: Matt Delco <delco@chromium.org> Signed-off-by: Jim Mattson <jmattson@google.com> Reported-by: syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com [Use READ_ONCE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-09-21 07:12:47 +02:00
..
arm	KVM: arm/arm64: Fix MMIO emulation data handling	2019-03-23 08:44:20 +01:00
async_pf.c	mm: replace get_user_pages_unlocked() write/force parameters with gup_flags	2018-12-17 21:55:16 +01:00
async_pf.h
coalesced_mmio.c	KVM: coalesced_mmio: add bounds checking	2019-09-21 07:12:47 +02:00
coalesced_mmio.h
eventfd.c	KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer	2018-08-24 13:27:00 +02:00
irqchip.c
Kconfig
kvm_main.c	KVM: Reject device ioctls from processes other than the VM's creator	2019-04-03 06:23:28 +02:00
vfio.c
vfio.h