From: Oliver Upton <oliver.upton@linux.dev>
To: kvmarm@lists.linux.dev
Cc: Marc Zyngier <maz@kernel.org>, James Morse <james.morse@arm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Zenghui Yu <yuzenghui@huawei.com>,
kvm@vger.kernel.org, Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Oliver Upton <oliver.upton@linux.dev>
Subject: [PATCH 0/2] KVM: arm64: Avoid NULL dereference in vgic-v2 device attr accessors
Date: Wed, 24 Apr 2024 17:39:57 +0000 [thread overview]
Message-ID: <20240424173959.3776798-1-oliver.upton@linux.dev> (raw)
Alex reports that it is possible to trigger a NULL dereference via the
vgic-v2 device attribute accessors, stemming from a lack of sanitization
of user input...
Here's a fix + regression test for the bug. Obviously, I intend to take
these as a fix ASAP.
Oliver Upton (2):
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF
arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 +--
.../testing/selftests/kvm/aarch64/vgic_init.c | 49 +++++++++++++++++++
2 files changed, 53 insertions(+), 4 deletions(-)
base-commit: fec50db7033ea478773b159e0e2efb135270e3b7
--
2.44.0.769.g3c40516874-goog
next reply other threads:[~2024-04-24 17:40 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-24 17:39 Oliver Upton [this message]
2024-04-24 17:39 ` [PATCH 1/2] KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() Oliver Upton
2024-04-24 17:39 ` [PATCH 2/2] KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF Oliver Upton
2024-04-24 18:06 ` [PATCH 0/2] KVM: arm64: Avoid NULL dereference in vgic-v2 device attr accessors Marc Zyngier
2024-04-24 19:15 ` Oliver Upton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240424173959.3776798-1-oliver.upton@linux.dev \
--to=oliver.upton@linux.dev \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=james.morse@arm.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.linux.dev \
--cc=maz@kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.