* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
@ 2025-08-06 9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Daniel Henrique Barboza @ 2025-08-06 9:59 UTC (permalink / raw)
To: Radim Krčmář, kvm-riscv
Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti, stable
On 8/5/25 7:44 AM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
@ 2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Nutty Liu @ 2025-08-06 10:05 UTC (permalink / raw)
To: Radim Krčmář, kvm-riscv
Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Daniel Henrique Barboza, stable
On 8/5/2025 6:44 PM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Thanks,
Nutty
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
@ 2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Anup Patel @ 2025-08-22 11:28 UTC (permalink / raw)
To: Radim Krčmář
Cc: kvm-riscv, kvm, linux-riscv, linux-kernel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Daniel Henrique Barboza, stable
On Tue, Aug 5, 2025 at 4:24 PM Radim Krčmář <rkrcmar@ventanamicro.com> wrote:
>
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Queued this as a fix for Linux-6.17
Thanks,
Anup
> ---
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
> --
> 2.50.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread