linux-riscv.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
@ 2025-08-05 10:44 Radim Krčmář
  2025-08-06  9:59 ` Daniel Henrique Barboza
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Radim Krčmář @ 2025-08-05 10:44 UTC (permalink / raw)
  To: kvm-riscv
  Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
	Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
	Daniel Henrique Barboza, stable

The userspace load can put up to 2048 bits into an xlen bit stack
buffer.  We want only xlen bits, so check the size beforehand.

Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
Cc: <stable@vger.kernel.org>
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
---
 arch/riscv/kvm/vcpu_vector.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
index a5f88cb717f3..05f3cc2d8e31 100644
--- a/arch/riscv/kvm/vcpu_vector.c
+++ b/arch/riscv/kvm/vcpu_vector.c
@@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
 		struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
 		unsigned long reg_val;
 
+		if (reg_size != sizeof(reg_val))
+			return -EINVAL;
 		if (copy_from_user(&reg_val, uaddr, reg_size))
 			return -EFAULT;
 		if (reg_val != cntx->vector.vlenb)
-- 
2.50.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
  2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
@ 2025-08-06  9:59 ` Daniel Henrique Barboza
  2025-08-06 10:05 ` Nutty Liu
  2025-08-22 11:28 ` Anup Patel
  2 siblings, 0 replies; 4+ messages in thread
From: Daniel Henrique Barboza @ 2025-08-06  9:59 UTC (permalink / raw)
  To: Radim Krčmář, kvm-riscv
  Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
	Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti, stable



On 8/5/25 7:44 AM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer.  We want only xlen bits, so check the size beforehand.
> 
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

>   arch/riscv/kvm/vcpu_vector.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
>   		struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
>   		unsigned long reg_val;
>   
> +		if (reg_size != sizeof(reg_val))
> +			return -EINVAL;
>   		if (copy_from_user(&reg_val, uaddr, reg_size))
>   			return -EFAULT;
>   		if (reg_val != cntx->vector.vlenb)


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
  2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
  2025-08-06  9:59 ` Daniel Henrique Barboza
@ 2025-08-06 10:05 ` Nutty Liu
  2025-08-22 11:28 ` Anup Patel
  2 siblings, 0 replies; 4+ messages in thread
From: Nutty Liu @ 2025-08-06 10:05 UTC (permalink / raw)
  To: Radim Krčmář, kvm-riscv
  Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
	Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
	Daniel Henrique Barboza, stable

On 8/5/2025 6:44 PM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer.  We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>

Thanks,
Nutty
>   arch/riscv/kvm/vcpu_vector.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
>   		struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
>   		unsigned long reg_val;
>   
> +		if (reg_size != sizeof(reg_val))
> +			return -EINVAL;
>   		if (copy_from_user(&reg_val, uaddr, reg_size))
>   			return -EFAULT;
>   		if (reg_val != cntx->vector.vlenb)

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
  2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
  2025-08-06  9:59 ` Daniel Henrique Barboza
  2025-08-06 10:05 ` Nutty Liu
@ 2025-08-22 11:28 ` Anup Patel
  2 siblings, 0 replies; 4+ messages in thread
From: Anup Patel @ 2025-08-22 11:28 UTC (permalink / raw)
  To: Radim Krčmář
  Cc: kvm-riscv, kvm, linux-riscv, linux-kernel, Atish Patra,
	Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
	Daniel Henrique Barboza, stable

On Tue, Aug 5, 2025 at 4:24 PM Radim Krčmář <rkrcmar@ventanamicro.com> wrote:
>
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer.  We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>

Queued this as a fix for Linux-6.17

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_vector.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
>                 struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
>                 unsigned long reg_val;
>
> +               if (reg_size != sizeof(reg_val))
> +                       return -EINVAL;
>                 if (copy_from_user(&reg_val, uaddr, reg_size))
>                         return -EFAULT;
>                 if (reg_val != cntx->vector.vlenb)
> --
> 2.50.0
>

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-23  6:28 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06  9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).