From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Jing Zhang <jingzhangos@google.com>, Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH 4.19.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
Date: Wed, 4 Dec 2024 17:11:30 -0500 [thread overview]
Message-ID: <20241204161704-8c258bd87fc66f81@stable.kernel.org> (raw)
In-Reply-To: <20241204202038.2714140-1-jingzhangos@google.com>
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022
Status in newer kernel trees:
6.12.y | Not found
6.11.y | Not found
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found
5.10.y | Not found
5.4.y | Not found
4.19.y | Not found
Note: The patch differs from the upstream commit:
---
1: 7fe28d7e68f92 ! 1: 841cc795e0665 KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
@@ Metadata
## Commit message ##
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
+ commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream.
+
In all the vgic_its_save_*() functinos, they do not check whether
the data length is 8 bytes before calling vgic_write_guest_lock.
This patch adds the check. To prevent the kernel from being blown up
@@ Commit message
Link: https://lore.kernel.org/r/20241107214137.428439-4-jingzhangos@google.com
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
- ## arch/arm64/kvm/vgic/vgic-its.c ##
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
+ ## virt/kvm/arm/vgic/vgic-its.c ##
+@@ virt/kvm/arm/vgic/vgic-its.c: static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
struct its_ite *ite, gpa_t gpa, int ite_esz)
{
@@ arch/arm64/kvm/vgic/vgic-its.c: static int scan_its_table(struct vgic_its *its,
u32 next_offset;
u64 val;
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
ite->collection->collection_id;
val = cpu_to_le64(val);
-- return vgic_write_guest_lock(kvm, gpa, &val, ite_esz);
+- return kvm_write_guest_lock(kvm, gpa, &val, ite_esz);
+
+ return vgic_its_write_entry_lock(its, gpa, val, ite_esz);
}
/**
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
gpa_t ptr, int dte_esz)
{
@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_restore_itt(struct vgic_its
u64 val, itt_addr_field;
u32 next_offset;
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
(itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
(dev->num_eventid_bits - 1));
val = cpu_to_le64(val);
-- return vgic_write_guest_lock(kvm, ptr, &val, dte_esz);
+- return kvm_write_guest_lock(kvm, ptr, &val, dte_esz);
+
+ return vgic_its_write_entry_lock(its, ptr, val, dte_esz);
}
/**
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_cte(struct vgic_its *its,
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_save_cte(struct vgic_its *its,
((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
collection->collection_id);
val = cpu_to_le64(val);
-- return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz);
+- return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz);
+
+ return vgic_its_write_entry_lock(its, gpa, val, esz);
}
- /*
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
+ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
u64 val;
int ret;
@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_restore_cte(struct vgic_its
if (ret)
return ret;
val = le64_to_cpu(val);
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_collection_table(struct vgic_its *its)
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_save_collection_table(struct vgic_its *its)
u64 baser = its->baser_coll_table;
- gpa_t gpa = GITS_BASER_ADDR_48_to_52(baser);
+ gpa_t gpa = BASER_ADDRESS(baser);
struct its_collection *collection;
- u64 val;
size_t max_size, filled = 0;
int ret, cte_esz = abi->cte_esz;
-@@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_collection_table(struct vgic_its *its)
+@@ virt/kvm/arm/vgic/vgic-its.c: static int vgic_its_save_collection_table(struct vgic_its *its)
* table is not fully filled, add a last dummy element
* with valid bit unset
*/
- val = 0;
- BUG_ON(cte_esz > sizeof(val));
-- ret = vgic_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
+- ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
- return ret;
+ return vgic_its_write_entry_lock(its, gpa, 0, cte_esz);
}
- /*
+ /**
- ## arch/arm64/kvm/vgic/vgic.h ##
-@@ arch/arm64/kvm/vgic/vgic.h: static inline int vgic_write_guest_lock(struct kvm *kvm, gpa_t gpa,
- return ret;
+ ## virt/kvm/arm/vgic/vgic.h ##
+@@
+ #define __KVM_ARM_VGIC_NEW_H__
+
+ #include <linux/irqchip/arm-gic-common.h>
++#include <asm/kvm_mmu.h>
+
+ #define PRODUCT_ID_KVM 0x4b /* ASCII code K */
+ #define IMPLEMENTER_ARM 0x43b
+@@ virt/kvm/arm/vgic/vgic.h: static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq)
+ return vgic_irq_get_lr_count(irq) > 1;
}
+static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr,
@@ arch/arm64/kvm/vgic/vgic.h: static inline int vgic_write_guest_lock(struct kvm *
+ if (KVM_BUG_ON(esize != sizeof(eval), kvm))
+ return -EINVAL;
+
-+ return vgic_write_guest_lock(kvm, eaddr, &eval, esize);
++ return kvm_write_guest_lock(kvm, eaddr, &eval, esize);
+}
+
/*
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-4.19.y | Success | Success |
next prev parent reply other threads:[~2024-12-04 23:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-04 20:20 [PATCH 4.19.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Jing Zhang
2024-12-04 20:20 ` [PATCH 4.19.y 2/3] KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device Jing Zhang
2024-12-04 22:11 ` Sasha Levin
2024-12-04 20:20 ` [PATCH 4.19.y 3/3] KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE Jing Zhang
2024-12-04 22:11 ` Sasha Levin
2024-12-04 22:11 ` Sasha Levin [this message]
2024-12-06 0:47 ` [PATCH 4.19.y 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Oliver Upton
2024-12-06 9:29 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241204161704-8c258bd87fc66f81@stable.kernel.org \
--to=sashal@kernel.org \
--cc=jingzhangos@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox