mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 10:09:10 +02:00
23e6a1ca04
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),
get_ext_report() allocates a buffer to retrieve a certificate blob from the
host, keeping track of its size in report_req->certs_len.
However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating
an invalid buffer size, as well as the expected length of such buffer.
get_ext_report() subsequently updates report_req->certs_len with the
host-controlled value, and cleans up the buffer by computing a page order
from such value. This is incorrect, as the host-provided length may not
match the page order of the original allocation, potentially resulting
in corruption in the page allocator.
Fix this by using alloc_pages_exact() instead, and reusing @npages to
compute the size passed to free_pages_exact(). For consistency, also
use @npages to compute the size when allocating the pages, even though
this last change has no functional effect.
Fixes:
|
||
|---|---|---|
| .. | ||
| acrn | ||
| coco | ||
| nitro_enclaves | ||
| vboxguest | ||
| fsl_hypervisor.c | ||
| Kconfig | ||
| Makefile | ||
| vmgenid.c | ||