* Re: [PATCH 1/2] vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() [not found] <20210716102239.96-1-xieyongji@bytedance.com> @ 2021-07-19 3:30 ` Jason Wang [not found] ` <20210716102239.96-2-xieyongji@bytedance.com> 1 sibling, 0 replies; 2+ messages in thread From: Jason Wang @ 2021-07-19 3:30 UTC (permalink / raw) To: Xie Yongji, mst, dan.carpenter; +Cc: linux-kernel, kvm, virtualization 在 2021/7/16 下午6:22, Xie Yongji 写道: > The "msg->iova + msg->size" addition can have an integer overflow > if the iotlb message is from a malicious user space application. > So let's fix it. > > Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Xie Yongji <xieyongji@bytedance.com> Acked-by: Jason Wang <jasowang@redhat.com> > --- > drivers/vhost/vdpa.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index 210ab35a7ebf..8e3c8790d493 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -615,6 +615,7 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, > int ret = 0; > > if (msg->iova < v->range.first || > + msg->iova - 1 > U64_MAX - msg->size || > msg->iova + msg->size - 1 > v->range.last) > return -EINVAL; > _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 2+ messages in thread
[parent not found: <20210716102239.96-2-xieyongji@bytedance.com>]
* Re: [PATCH 2/2] vhost: Fix the calculation in vhost_overflow() [not found] ` <20210716102239.96-2-xieyongji@bytedance.com> @ 2021-07-19 3:30 ` Jason Wang 0 siblings, 0 replies; 2+ messages in thread From: Jason Wang @ 2021-07-19 3:30 UTC (permalink / raw) To: Xie Yongji, mst, dan.carpenter; +Cc: linux-kernel, kvm, virtualization 在 2021/7/16 下午6:22, Xie Yongji 写道: > This fixes the incorrect calculation for integer overflow > when the last address of iova range is 0xffffffff. > > Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around“) > Reported-by: Jason Wang <jasowang@redhat.com> > Signed-off-by: Xie Yongji <xieyongji@bytedance.com> > --- > drivers/vhost/vhost.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index b9e853e6094d..a9fd1b311d2f 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -738,7 +738,8 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) > static bool vhost_overflow(u64 uaddr, u64 size) > { > /* Make sure 64 bit math will not overflow. */ > - return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; > + return uaddr > ULONG_MAX || size > ULONG_MAX || > + uaddr - 1 > ULONG_MAX - size; > } Acked-by: Jason Wang <jasowang@redhat.com> > > /* Caller should have vq mutex and device mutex. */ _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-07-19 3:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20210716102239.96-1-xieyongji@bytedance.com>
2021-07-19 3:30 ` [PATCH 1/2] vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() Jason Wang
[not found] ` <20210716102239.96-2-xieyongji@bytedance.com>
2021-07-19 3:30 ` [PATCH 2/2] vhost: Fix the calculation in vhost_overflow() Jason Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).