Re: [PATCH v9 24/27] virt: gunyah: Add proxy-scheduled vCPUs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2/9/2023 10:54 PM, Srivatsa Vaddagiri wrote:
* Srivatsa Vaddagiri <quic_svaddagi@xxxxxxxxxxx> [2023-02-09 16:10:06]:

* Elliot Berman <quic_eberman@xxxxxxxxxxx> [2023-01-20 14:46:23]:

+static void gh_handle_mmio_return(struct gunyah_vcpu *vcpu, u64 *state)
+{
+	if (!vcpu->vcpu_run->mmio.is_write)
+		memcpy(&state[0], vcpu->vcpu_run->mmio.data, vcpu->vcpu_run->mmio.len);

Would be good to do a bound check on length of memcpy I think (in case
vcpu_run_resp->state_data[1] is wrong for example).

I think this is the right place to ensure right value is passed. Right now, vcpu_run->mmio.len is user accessible and easily provides ability for buffer overrun if unchecked. I'm now preserving the length Gunyah requested in internal vcpu structure. Userspace can write whatever they want to the mmio request, but it won't change the number of bytes that we copy from user.


Sorry I meant to comment that for the other memcpy you had!

+               memcpy(vcpu->vcpu_run->mmio.data, &vcpu_run_resp->state_data[2],
+                       vcpu_run_resp->state_data[1]);



Per Srini and Alex, we can trust the values hypervisor sends, so I think we can skip this check.

https://lore.kernel.org/all/4a584563-1fb7-22fa-5e16-e0cf5e88b76b@xxxxxxxxxx/

Thanks,
Elliot



[Index of Archives]     [Device Tree Compilter]     [Device Tree Spec]     [Linux Driver Backports]     [Video for Linux]     [Linux USB Devel]     [Linux PCI Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Yosemite Backpacking]


  Powered by Linux