Hi Andre, On 04/10/2015 11:17 AM, Andre Przywara wrote: > When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently > only check it against a fixed limit, which historically is set > to 127. With the new dynamic IRQ allocation the effective limit may > actually be smaller (64). > So when now a malicious or buggy userland injects a SPI in that > range, we spill over on our VGIC bitmaps and bytemaps memory. > I could trigger a host kernel NULL pointer dereference with current > mainline by injecting some bogus IRQ number from a hacked kvmtool: > --- a/arch/arm/include/uapi/asm/kvm.h > +++ b/arch/arm/include/uapi/asm/kvm.h > @@ -195,7 +195,11 @@ struct kvm_arch_memory_slot { > #define KVM_ARM_IRQ_CPU_IRQ 0 > #define KVM_ARM_IRQ_CPU_FIQ 1 > > -/* Highest supported SPI, from VGIC_NR_IRQS */ > +/* > + * This used to hold the highest supported SPI, but it is now obsolete > + * and only here to provide source code level compatibility with older > + * userland. The highest SPI number can be set via KVM_DEV_ARM_VGIC_GRP_NR_IRQS. > + */ > #define KVM_ARM_IRQ_GIC_MAX 127 If that's the case should it maybe only defined when __KERNEL__ is not defined? Chris -- Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html