| From foo@baz Sun May 27 17:33:37 CEST 2018 |
| From: Paolo Bonzini <pbonzini@redhat.com> |
| Date: Thu, 26 Oct 2017 15:45:47 +0200 |
| Subject: kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl |
| |
| From: Paolo Bonzini <pbonzini@redhat.com> |
| |
| [ Upstream commit 51776043afa415435c7e4636204fbe4f7edc4501 ] |
| |
| This ioctl is obsolete (it was used by Xenner as far as I know) but |
| still let's not break it gratuitously... Its handler is copying |
| directly into struct kvm. Go through a bounce buffer instead, with |
| the added benefit that we can actually do something useful with the |
| flags argument---the previous code was exiting with -EINVAL but still |
| doing the copy. |
| |
| This technically is a userspace ABI breakage, but since no one should be |
| using the ioctl, it's a good occasion to see if someone actually |
| complains. |
| |
| Cc: kernel-hardening@lists.openwall.com |
| Cc: Kees Cook <keescook@chromium.org> |
| Cc: Radim Krčmář <rkrcmar@redhat.com> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/x86/kvm/x86.c | 7 ++++--- |
| 1 file changed, 4 insertions(+), 3 deletions(-) |
| |
| --- a/arch/x86/kvm/x86.c |
| +++ b/arch/x86/kvm/x86.c |
| @@ -4131,13 +4131,14 @@ long kvm_arch_vm_ioctl(struct file *filp |
| mutex_unlock(&kvm->lock); |
| break; |
| case KVM_XEN_HVM_CONFIG: { |
| + struct kvm_xen_hvm_config xhc; |
| r = -EFAULT; |
| - if (copy_from_user(&kvm->arch.xen_hvm_config, argp, |
| - sizeof(struct kvm_xen_hvm_config))) |
| + if (copy_from_user(&xhc, argp, sizeof(xhc))) |
| goto out; |
| r = -EINVAL; |
| - if (kvm->arch.xen_hvm_config.flags) |
| + if (xhc.flags) |
| goto out; |
| + memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc)); |
| r = 0; |
| break; |
| } |