Re: [PATCH 2/2] KVM: s390: prevent buffer overrun on memory hotplug during migration

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 21.12.2017 10:04, Christian Borntraeger wrote:
> We must not go beyond the pre-allocated buffer. This can happen when
> a new memory slot is added during migration.
> 
> Reported-by: David Hildenbrand <david@xxxxxxxxxx>
> Signed-off-by: Christian Borntraeger <borntraeger@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx # 4.13+
> Fixes: 190df4a212a7 (KVM: s390: CMMA tracking, ESSA emulation, migration mode)
> ---
>  arch/s390/kvm/priv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index c954ac49eee4..3211bf58d838 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
> @@ -1002,7 +1002,7 @@ static inline int do_essa(struct kvm_vcpu *vcpu, const int orc)
>  		cbrlo[entries] = gfn << PAGE_SHIFT;
>  	}
>  
> -	if (orc) {
> +	if (orc && gfn < ms->bitmap_size) {
>  		/* increment only if we are really flipping the bit to 1 */
>  		if (!test_and_set_bit(gfn, ms->pgste_bitmap))
>  			atomic64_inc(&ms->dirty_pages);
> 

Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>

-- 

Thanks,

David / dhildenb



[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux