Re: [PATCH 2/2] KVM: s390: prevent buffer overrun on memory hotplug during migration

[David Hildenbrand <david@redhat.com>]

On 21.12.2017 10:04, Christian Borntraeger wrote:
> We must not go beyond the pre-allocated buffer. This can happen when
> a new memory slot is added during migration.
> 
> Reported-by: David Hildenbrand <david@redhat.com>
> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
> Cc: stable@vger.kernel.org # 4.13+
> Fixes: 190df4a212a7 (KVM: s390: CMMA tracking, ESSA emulation, migration mode)
> ---
>  arch/s390/kvm/priv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index c954ac49eee4..3211bf58d838 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
> @@ -1002,7 +1002,7 @@ static inline int do_essa(struct kvm_vcpu *vcpu, const int orc)
>  		cbrlo[entries] = gfn << PAGE_SHIFT;
>  	}
>  
> -	if (orc) {
> +	if (orc && gfn < ms->bitmap_size) {
>  		/* increment only if we are really flipping the bit to 1 */
>  		if (!test_and_set_bit(gfn, ms->pgste_bitmap))
>  			atomic64_inc(&ms->dirty_pages);
> 

Reviewed-by: David Hildenbrand <david@redhat.com>

-- 

Thanks,

David / dhildenb