On Fri, Apr 10, 2015 at 04:17:59PM +0100, Andre Przywara wrote: > When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently > only check it against a fixed limit, which historically is set > to 127. With the new dynamic IRQ allocation the effective limit may > actually be smaller (64). > So when now a malicious or buggy userland injects a SPI in that > range, we spill over on our VGIC bitmaps and bytemaps memory. > I could trigger a host kernel NULL pointer dereference with current > mainline by injecting some bogus IRQ number from a hacked kvmtool: > ----------------- > .... > DEBUG: kvm_vgic_inject_irq(kvm, cpu=0, irq=114, level=1) > DEBUG: vgic_update_irq_pending(kvm, cpu=0, irq=114, level=1) > DEBUG: IRQ #114 still in the game, writing to bytemap now... > Unable to handle kernel NULL pointer dereference at virtual address 00000000 > pgd = ffffffc07652e000 > [00000000] *pgd=00000000f658b003, *pud=00000000f658b003, *pmd=0000000000000000 > Internal error: Oops: 96000006 [#1] PREEMPT SMP > Modules linked in: > CPU: 1 PID: 1053 Comm: lkvm-msi-irqinj Not tainted 4.0.0-rc7+ #3027 > Hardware name: FVP Base (DT) > task: ffffffc0774e9680 ti: ffffffc0765a8000 task.ti: ffffffc0765a8000 > PC is at kvm_vgic_inject_irq+0x234/0x310 > LR is at kvm_vgic_inject_irq+0x30c/0x310 > pc : [<ffffffc0000ae0a8>] lr : [<ffffffc0000ae180>] pstate: 80000145 > ..... > > So this patch fixes this by checking the SPI number against the > actual limit. Also we remove the former legacy hard limit of > 127 in the ioctl code. > > Signed-off-by: Andre Przywara <andre.przywara@xxxxxxx> > CC: <stable@xxxxxxxxxxxxxxx> # 4.0, 3.19, 3.18 Reviewed-by: Christoffer Dall <christoffer.dall@xxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
