From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cornelia Huck Subject: Re: [PATCH 2/2] KVM: s390: prevent buffer overrun on memory hotplug during migration Date: Thu, 21 Dec 2017 10:36:30 +0100 Message-ID: <20171221103630.235c4ed5.cohuck@redhat.com> References: <20171221090416.17351-1-borntraeger@de.ibm.com> <20171221090416.17351-3-borntraeger@de.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: KVM , linux-s390 , David Hildenbrand , Claudio Imbrenda To: Christian Borntraeger Return-path: Received: from mx1.redhat.com ([209.132.183.28]:56985 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751542AbdLUJgi (ORCPT ); Thu, 21 Dec 2017 04:36:38 -0500 In-Reply-To: <20171221090416.17351-3-borntraeger@de.ibm.com> Sender: kvm-owner@vger.kernel.org List-ID: On Thu, 21 Dec 2017 10:04:16 +0100 Christian Borntraeger wrote: > We must not go beyond the pre-allocated buffer. This can happen when > a new memory slot is added during migration. > > Reported-by: David Hildenbrand > Signed-off-by: Christian Borntraeger > Cc: stable@vger.kernel.org # 4.13+ > Fixes: 190df4a212a7 (KVM: s390: CMMA tracking, ESSA emulation, migration mode) > --- > arch/s390/kvm/priv.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c > index c954ac49eee4..3211bf58d838 100644 > --- a/arch/s390/kvm/priv.c > +++ b/arch/s390/kvm/priv.c > @@ -1002,7 +1002,7 @@ static inline int do_essa(struct kvm_vcpu *vcpu, const int orc) > cbrlo[entries] = gfn << PAGE_SHIFT; > } > > - if (orc) { > + if (orc && gfn < ms->bitmap_size) { > /* increment only if we are really flipping the bit to 1 */ > if (!test_and_set_bit(gfn, ms->pgste_bitmap)) > atomic64_inc(&ms->dirty_pages); Reviewed-by: Cornelia Huck