Commit 4030b4c5 authored by Tianyu Lan's avatar Tianyu Lan Committed by Ingo Molnar

x86/hyper-v: Fix overflow bug in fill_gva_list()

When the 'start' parameter is >=  0xFF000000 on 32-bit
systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems,
fill_gva_list() gets into an infinite loop.

With such inputs, 'cur' overflows after adding HV_TLB_FLUSH_UNIT
and always compares as less than end.  Memory is filled with
guest virtual addresses until the system crashes.

Fix this by never incrementing 'cur' to be larger than 'end'.
Reported-by: default avatarJong Hyun Park <park.jonghyun@yonsei.ac.kr>
Signed-off-by: default avatarTianyu Lan <Tianyu.Lan@microsoft.com>
Reviewed-by: default avatarMichael Kelley <mikelley@microsoft.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 2ffd9e33 ("x86/hyper-v: Use hypercall for remote TLB flush")
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 9b8bd476
...@@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset, ...@@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
* Lower 12 bits encode the number of additional * Lower 12 bits encode the number of additional
* pages to flush (in addition to the 'cur' page). * pages to flush (in addition to the 'cur' page).
*/ */
if (diff >= HV_TLB_FLUSH_UNIT) if (diff >= HV_TLB_FLUSH_UNIT) {
gva_list[gva_n] |= ~PAGE_MASK; gva_list[gva_n] |= ~PAGE_MASK;
else if (diff) cur += HV_TLB_FLUSH_UNIT;
} else if (diff) {
gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT; gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
cur = end;
}
cur += HV_TLB_FLUSH_UNIT;
gva_n++; gva_n++;
} while (cur < end); } while (cur < end);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment