Matt Delco 232a6462f4 KVM: coalesced_mmio: add bounds checking ... commit b60fe990c6 upstream. The first/last indexes are typically shared with a user app. The app can change the 'last' index that the kernel uses to store the next result. This change sanity checks the index before using it for writing to a potentially arbitrary address. This fixes CVE-2019-14821. Cc: stable@vger.kernel.org Fixes: 5f94c1741b ("KVM: Add coalesced MMIO support (common part)") Signed-off-by: Matt Delco <delco@chromium.org> Signed-off-by: Jim Mattson <jmattson@google.com> Reported-by: syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com [Use READ_ONCE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-09-21 07:16:44 +02:00
..
arm	KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity	2019-09-10 10:33:53 +01:00
async_pf.c	sched/swait: Rename to exclusive	2018-06-20 11:35:56 +02:00
async_pf.h	KVM: fix checkpatch.pl errors in kvm/async_pf.h	2015-06-19 17:16:25 +02:00
coalesced_mmio.c	KVM: coalesced_mmio: add bounds checking	2019-09-21 07:16:44 +02:00
coalesced_mmio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
eventfd.c	kvm: Check irqchip mode before assign irqfd	2019-09-16 08:22:15 +02:00
irqchip.c	KVM: fix spectrev1 gadgets	2019-05-16 19:41:22 +02:00
Kconfig	KVM: arm64: Prevent KVM_COMPAT from being selected	2018-06-21 17:17:50 +01:00
kvm_main.c	KVM: Fix leak vCPU's VMCS value into other pCPU	2019-08-16 10:12:53 +02:00
vfio.c	vfio: New external user group/file match	2017-06-28 13:50:05 -06:00
vfio.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00