linux/arch
Andre Przywara fd1d0ddf2a KVM: arm/arm64: check IRQ number on userland injection
When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently
only check it against a fixed limit, which historically is set
to 127. With the new dynamic IRQ allocation the effective limit may
actually be smaller (64).
So when now a malicious or buggy userland injects a SPI in that
range, we spill over on our VGIC bitmaps and bytemaps memory.
I could trigger a host kernel NULL pointer dereference with current
mainline by injecting some bogus IRQ number from a hacked kvmtool:
-----------------
....
DEBUG: kvm_vgic_inject_irq(kvm, cpu=0, irq=114, level=1)
DEBUG: vgic_update_irq_pending(kvm, cpu=0, irq=114, level=1)
DEBUG: IRQ #114 still in the game, writing to bytemap now...
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = ffffffc07652e000
[00000000] *pgd=00000000f658b003, *pud=00000000f658b003, *pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 1053 Comm: lkvm-msi-irqinj Not tainted 4.0.0-rc7+ #3027
Hardware name: FVP Base (DT)
task: ffffffc0774e9680 ti: ffffffc0765a8000 task.ti: ffffffc0765a8000
PC is at kvm_vgic_inject_irq+0x234/0x310
LR is at kvm_vgic_inject_irq+0x30c/0x310
pc : [<ffffffc0000ae0a8>] lr : [<ffffffc0000ae180>] pstate: 80000145
.....

So this patch fixes this by checking the SPI number against the
actual limit. Also we remove the former legacy hard limit of
127 in the ioctl code.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
CC: <stable@vger.kernel.org> # 4.0, 3.19, 3.18
[maz: wrap KVM_ARM_IRQ_GIC_MAX with #ifndef __KERNEL__,
as suggested by Christopher Covington]
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2015-04-22 15:42:24 +01:00
..
alpha PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
arc ARC: signal handling robustify 2015-03-26 11:19:36 +05:30
arm KVM: arm/arm64: check IRQ number on userland injection 2015-04-22 15:42:24 +01:00
arm64 KVM: arm/arm64: check IRQ number on userland injection 2015-04-22 15:42:24 +01:00
avr32 avr32: fix integer overflow in ELF_ET_DYN_BASE 2015-04-13 18:48:55 +02:00
blackfin Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2015-02-21 12:59:04 -08:00
c6x arch/c6x/include/asm/pgtable.h: define dummy pgprot_writecombine for !MMU 2015-03-12 18:46:08 -07:00
cris CRIS changes for 3.20 2015-02-15 18:02:02 -08:00
frv Merge branches 'pci/enumeration' and 'pci/virtualization' into next 2015-03-23 17:17:34 -05:00
hexagon all arches, signal: move restart_block to struct task_struct 2015-02-12 18:54:12 -08:00
ia64 PCI: Assign resources before drivers claim devices (pci_scan_root_bus()) 2015-03-19 10:17:13 -05:00
m32r mm: add missing __PAGETABLE_{PUD,PMD}_FOLDED defines 2015-02-28 09:57:51 -08:00
m68k PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
metag metag: Fix ioremap_wc/ioremap_cached build errors 2015-03-23 12:32:37 +00:00
microblaze Merge branches 'pci/enumeration' and 'pci/virtualization' into next 2015-03-23 17:17:34 -05:00
mips Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-04-13 15:54:50 -07:00
mn10300 Merge branches 'pci/enumeration' and 'pci/virtualization' into next 2015-03-23 17:17:34 -05:00
nios2 nios2: fix cache coherency issue when debug with gdb 2015-04-10 11:10:08 +08:00
openrisc asm-generic: uaccess.h cleanup 2015-02-18 10:02:24 -08:00
parisc parisc: Fix pmd code to depend on PT_NLEVELS value, not on CONFIG_64BIT 2015-03-23 12:28:16 +01:00
powerpc Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-04-13 10:27:28 -07:00
s390 PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
score all arches, signal: move restart_block to struct task_struct 2015-02-12 18:54:12 -08:00
sh PCI: Cleanup control flow 2015-03-19 10:17:22 -05:00
sparc PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
tile PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
um all arches, signal: move restart_block to struct task_struct 2015-02-12 18:54:12 -08:00
unicore32 PCI: Assign resources before drivers claim devices (pci_scan_bus()) 2015-03-12 15:04:01 -05:00
x86 PCI changes for the v4.1 merge window: 2015-04-13 15:45:47 -07:00
xtensa PCI: Assign resources before drivers claim devices (pci_scan_root_bus()) 2015-03-19 10:17:13 -05:00
.gitignore
Kconfig