Andre Przywara fd1d0ddf2a KVM: arm/arm64: check IRQ number on userland injection ... When userland injects a SPI via the KVM_IRQ_LINE ioctl we currently only check it against a fixed limit, which historically is set to 127. With the new dynamic IRQ allocation the effective limit may actually be smaller (64). So when now a malicious or buggy userland injects a SPI in that range, we spill over on our VGIC bitmaps and bytemaps memory. I could trigger a host kernel NULL pointer dereference with current mainline by injecting some bogus IRQ number from a hacked kvmtool: ----------------- .... DEBUG: kvm_vgic_inject_irq(kvm, cpu=0, irq=114, level=1) DEBUG: vgic_update_irq_pending(kvm, cpu=0, irq=114, level=1) DEBUG: IRQ #114 still in the game, writing to bytemap now... Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = ffffffc07652e000 [00000000] *pgd=00000000f658b003, *pud=00000000f658b003, *pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 1053 Comm: lkvm-msi-irqinj Not tainted 4.0.0-rc7+ #3027 Hardware name: FVP Base (DT) task: ffffffc0774e9680 ti: ffffffc0765a8000 task.ti: ffffffc0765a8000 PC is at kvm_vgic_inject_irq+0x234/0x310 LR is at kvm_vgic_inject_irq+0x30c/0x310 pc : [<ffffffc0000ae0a8>] lr : [<ffffffc0000ae180>] pstate: 80000145 ..... So this patch fixes this by checking the SPI number against the actual limit. Also we remove the former legacy hard limit of 127 in the ioctl code. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org> CC: <stable@vger.kernel.org> # 4.0, 3.19, 3.18 [maz: wrap KVM_ARM_IRQ_GIC_MAX with #ifndef __KERNEL__, as suggested by Christopher Covington] Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>		2015-04-22 15:42:24 +01:00
..
auxvec.h
bitsperlong.h
byteorder.h	arm64: big-endian: fix byteorder include	2013-10-25 15:59:32 +01:00
fcntl.h
hwcap.h	arm64: Add hwcaps for crypto and CRC32 extensions.	2013-12-19 17:44:08 +00:00
Kbuild	arm64: uapi: expose our struct ucontext to the uapi headers	2015-01-23 18:07:49 +00:00
kvm.h	KVM: arm/arm64: check IRQ number on userland injection	2015-04-22 15:42:24 +01:00
param.h
perf_regs.h	ARM64: perf: add support for perf registers API	2014-03-13 11:22:37 +00:00
posix_types.h	arm64: uid16: fix __kernel_old_{gid,uid}_t definitions	2014-06-18 12:41:09 +01:00
ptrace.h	arm64: ptrace: make structure padding explicit for debug registers	2012-10-18 20:15:31 +01:00
setup.h
sigcontext.h	arm64: fix build error in sigcontext.h	2014-06-18 12:41:56 +01:00
siginfo.h
signal.h
stat.h
statfs.h
ucontext.h	arm64: uapi: expose our struct ucontext to the uapi headers	2015-01-23 18:07:49 +00:00
unistd.h