* [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
@ 2025-08-05 10:44 Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Radim Krčmář @ 2025-08-05 10:44 UTC (permalink / raw)
To: kvm-riscv
Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Daniel Henrique Barboza, stable
The userspace load can put up to 2048 bits into an xlen bit stack
buffer. We want only xlen bits, so check the size beforehand.
Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
Cc: <stable@vger.kernel.org>
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
---
arch/riscv/kvm/vcpu_vector.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
index a5f88cb717f3..05f3cc2d8e31 100644
--- a/arch/riscv/kvm/vcpu_vector.c
+++ b/arch/riscv/kvm/vcpu_vector.c
@@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
unsigned long reg_val;
+ if (reg_size != sizeof(reg_val))
+ return -EINVAL;
if (copy_from_user(®_val, uaddr, reg_size))
return -EFAULT;
if (reg_val != cntx->vector.vlenb)
--
2.50.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
@ 2025-08-06 9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Daniel Henrique Barboza @ 2025-08-06 9:59 UTC (permalink / raw)
To: Radim Krčmář, kvm-riscv
Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti, stable
On 8/5/25 7:44 AM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
@ 2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Nutty Liu @ 2025-08-06 10:05 UTC (permalink / raw)
To: Radim Krčmář, kvm-riscv
Cc: kvm, linux-riscv, linux-kernel, Anup Patel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Daniel Henrique Barboza, stable
On 8/5/2025 6:44 PM, Radim Krčmář wrote:
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
> ---
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Thanks,
Nutty
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
@ 2025-08-22 11:28 ` Anup Patel
2 siblings, 0 replies; 4+ messages in thread
From: Anup Patel @ 2025-08-22 11:28 UTC (permalink / raw)
To: Radim Krčmář
Cc: kvm-riscv, kvm, linux-riscv, linux-kernel, Atish Patra,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Daniel Henrique Barboza, stable
On Tue, Aug 5, 2025 at 4:24 PM Radim Krčmář <rkrcmar@ventanamicro.com> wrote:
>
> The userspace load can put up to 2048 bits into an xlen bit stack
> buffer. We want only xlen bits, so check the size beforehand.
>
> Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Queued this as a fix for Linux-6.17
Thanks,
Anup
> ---
> arch/riscv/kvm/vcpu_vector.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
> index a5f88cb717f3..05f3cc2d8e31 100644
> --- a/arch/riscv/kvm/vcpu_vector.c
> +++ b/arch/riscv/kvm/vcpu_vector.c
> @@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(struct kvm_vcpu *vcpu,
> struct kvm_cpu_context *cntx = &vcpu->arch.guest_context;
> unsigned long reg_val;
>
> + if (reg_size != sizeof(reg_val))
> + return -EINVAL;
> if (copy_from_user(®_val, uaddr, reg_size))
> return -EFAULT;
> if (reg_val != cntx->vector.vlenb)
> --
> 2.50.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-22 11:29 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-05 10:44 [PATCH] RISC-V: KVM: fix stack overrun when loading vlenb Radim Krčmář
2025-08-06 9:59 ` Daniel Henrique Barboza
2025-08-06 10:05 ` Nutty Liu
2025-08-22 11:28 ` Anup Patel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).