|
 |
9f1cdfc |
Bugzilla: 1042071
|
|
|
9f1cdfc |
Upstream-status: 3.13 and sent to stable
|
|
|
9f1cdfc |
Delivered-To: jwboyer@gmail.com
|
|
|
9f1cdfc |
Received: by 10.76.104.107 with SMTP id gd11csp361298oab;
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 12:41:21 -0800 (PST)
|
|
|
9f1cdfc |
X-Received: by 10.50.109.132 with SMTP id hs4mr33803866igb.34.1386880880893;
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 12:41:20 -0800 (PST)
|
|
|
9f1cdfc |
Return-Path: <stable-owner@vger.kernel.org>
|
|
|
9f1cdfc |
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
|
|
|
9f1cdfc |
by mx.google.com with ESMTP id q8si17378346pav.173.2013.12.12.12.40.57
|
|
|
9f1cdfc |
for <multiple recipients>;
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 12:41:20 -0800 (PST)
|
|
|
9f1cdfc |
Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
|
|
|
9f1cdfc |
Authentication-Results: mx.google.com;
|
|
|
9f1cdfc |
spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=stable-owner@vger.kernel.org;
|
|
|
9f1cdfc |
dkim=neutral (bad format) header.i=@gmail.com
|
|
|
9f1cdfc |
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
|
|
9f1cdfc |
id S1752041Ab3LLUhR (ORCPT <rfc822;kumadasu@gmail.com> + 64 others);
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 15:37:17 -0500
|
|
|
9f1cdfc |
Received: from mail-ea0-f179.google.com ([209.85.215.179]:43785 "EHLO
|
|
|
9f1cdfc |
mail-ea0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
|
|
|
9f1cdfc |
with ESMTP id S1751761Ab3LLUhN (ORCPT
|
|
|
9f1cdfc |
<rfc822;stable@vger.kernel.org>); Thu, 12 Dec 2013 15:37:13 -0500
|
|
|
9f1cdfc |
Received: by mail-ea0-f179.google.com with SMTP id r15so485140ead.24
|
|
|
9f1cdfc |
for <multiple recipients>; Thu, 12 Dec 2013 12:37:11 -0800 (PST)
|
|
|
9f1cdfc |
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
|
|
|
9f1cdfc |
d=gmail.com; s=20120113;
|
|
|
9f1cdfc |
h=sender:from:to:cc:subject:date:message-id;
|
|
|
9f1cdfc |
bh=3nLdta59rbActmGe9iq6aMqjNBfzfF7lqy0gb7EeI0I=;
|
|
|
9f1cdfc |
b=fWKHZKszZQjXAVDzYAlwX8s4+UNEomYiCAX0zvDzW7A5Yiy28MUt0QbNu6288Pu+Qs
|
|
|
9f1cdfc |
NJ38SpDcPLWzGknYOLggLa21nXsv4tX9vp4FFEY4i3H5iCVpXbvxIc+n9ZVOzWY2wkxK
|
|
|
9f1cdfc |
HR1Xf24kJ9FPuV/LoIyu5RlHZUm95BoAe7TxRZWlkcxQ0vEOSAyZQwH4EIj6SS7fXI1d
|
|
|
9f1cdfc |
PoqZKm7100ib0/wm6I49cF2b0EXRTSOYrgZneyniPVGpfTkpN2atNcEgdLSvAWQKEI+p
|
|
|
9f1cdfc |
79Dt0/BJd2CIuqgUbZBlA8pH6a119FtfrVqxVWJAmVvsv9lpkMIjJrFTj9yqpUFKeeYB
|
|
|
9f1cdfc |
XTeA==
|
|
|
9f1cdfc |
X-Received: by 10.14.6.136 with SMTP id 8mr9978716een.11.1386880631657;
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 12:37:11 -0800 (PST)
|
|
|
9f1cdfc |
Received: from playground.com (net-2-35-202-54.cust.dsl.vodafone.it. [2.35.202.54])
|
|
|
9f1cdfc |
by mx.google.com with ESMTPSA id o47sm70323739eem.21.2013.12.12.12.37.00
|
|
|
9f1cdfc |
for <multiple recipients>
|
|
|
9f1cdfc |
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
|
|
|
9f1cdfc |
Thu, 12 Dec 2013 12:37:01 -0800 (PST)
|
|
|
9f1cdfc |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9f1cdfc |
To: linux-kernel@vger.kernel.org
|
|
|
9f1cdfc |
Cc: gleb@redhat.com, kvm@vger.kernel.org, pmatouse@redhat.com,
|
|
|
9f1cdfc |
Andy Honig <ahonig@google.com>, stable@vger.kernel.org
|
|
|
9f1cdfc |
Subject: [PATCH] KVM: Improve create VCPU parameter
|
|
|
9f1cdfc |
Date: Thu, 12 Dec 2013 21:36:51 +0100
|
|
|
9f1cdfc |
Message-Id: <1386880614-23300-1-git-send-email-pbonzini@redhat.com>
|
|
|
9f1cdfc |
X-Mailer: git-send-email 1.8.3.1
|
|
|
9f1cdfc |
Sender: stable-owner@vger.kernel.org
|
|
|
9f1cdfc |
Precedence: bulk
|
|
|
9f1cdfc |
List-ID: <stable.vger.kernel.org>
|
|
|
9f1cdfc |
X-Mailing-List: stable@vger.kernel.org
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
From: Andy Honig <ahonig@google.com>
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
In multiple functions the vcpu_id is used as an offset into a bitfield. Ag
|
|
|
9f1cdfc |
malicious user could specify a vcpu_id greater than 255 in order to set or
|
|
|
9f1cdfc |
clear bits in kernel memory. This could be used to elevate priveges in the
|
|
|
9f1cdfc |
kernel. This patch verifies that the vcpu_id provided is less than 255.
|
|
|
9f1cdfc |
The api documentation already specifies that the vcpu_id must be less than
|
|
|
9f1cdfc |
max_vcpus, but this is currently not checked.
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
Reported-by: Andrew Honig <ahonig@google.com>
|
|
|
9f1cdfc |
Cc: stable@vger.kernel.org
|
|
|
9f1cdfc |
Signed-off-by: Andrew Honig <ahonig@google.com>
|
|
|
9f1cdfc |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9f1cdfc |
---
|
|
|
9f1cdfc |
virt/kvm/kvm_main.c | 3 +++
|
|
|
9f1cdfc |
1 file changed, 3 insertions(+)
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
|
9f1cdfc |
index a0aa84b5941a..4f588bc94186 100644
|
|
|
9f1cdfc |
--- a/virt/kvm/kvm_main.c
|
|
|
9f1cdfc |
+++ b/virt/kvm/kvm_main.c
|
|
|
9f1cdfc |
@@ -1898,6 +1898,9 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
|
|
|
9f1cdfc |
int r;
|
|
|
9f1cdfc |
struct kvm_vcpu *vcpu, *v;
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
+ if (id >= KVM_MAX_VCPUS)
|
|
|
9f1cdfc |
+ return -EINVAL;
|
|
|
9f1cdfc |
+
|
|
|
9f1cdfc |
vcpu = kvm_arch_vcpu_create(kvm, id);
|
|
|
9f1cdfc |
if (IS_ERR(vcpu))
|
|
|
9f1cdfc |
return PTR_ERR(vcpu);
|
|
|
9f1cdfc |
--
|
|
|
9f1cdfc |
1.8.3.1
|
|
|
9f1cdfc |
|
|
|
9f1cdfc |
--
|
|
|
9f1cdfc |
To unsubscribe from this list: send the line "unsubscribe stable" in
|
|
|
9f1cdfc |
the body of a message to majordomo@vger.kernel.org
|
|
|
9f1cdfc |
More majordomo info at http://vger.kernel.org/majordomo-info.html
|