Tianyu Lan d73515a17c x86/hyper-v: Fix overflow bug in fill_gva_list() ... [ Upstream commit 4030b4c585 ] When the 'start' parameter is >= 0xFF000000 on 32-bit systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems, fill_gva_list() gets into an infinite loop. With such inputs, 'cur' overflows after adding HV_TLB_FLUSH_UNIT and always compares as less than end. Memory is filled with guest virtual addresses until the system crashes. Fix this by never incrementing 'cur' to be larger than 'end'. Reported-by: Jong Hyun Park <park.jonghyun@yonsei.ac.kr> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: 2ffd9e33ce ("x86/hyper-v: Use hypercall for remote TLB flush") Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-09-21 07:17:13 +02:00
..
hv_apic.c	x86/hyper-v: rename ipi_arg_{ex,non_ex} structures	2018-09-20 00:51:42 +02:00
hv_init.c	x86/hyperv: Prevent potential NULL pointer dereference	2019-04-20 09:15:59 +02:00
Makefile	X86/Hyper-V: Add flush HvFlushGuestPhysicalAddressSpace hypercall support	2018-08-06 17:59:04 +02:00
mmu.c	x86/hyper-v: Fix overflow bug in fill_gva_list()	2019-09-21 07:17:13 +02:00
nested.c	X86/Hyper-V: Add hyperv_nested_flush_guest_mapping ftrace support	2018-08-06 17:59:05 +02:00