Merge tag 'kvm-x86-generic-6.8' of https://github.com/kvm-x86/linux i…

…nto HEAD Common KVM changes for 6.8: - Use memdup_array_user() to harden against overflow. - Unconditionally advertise KVM_CAP_DEVICE_CTRL for all architectures.
torvalds · Jan 8, 2024 · fb872da · fb872da
2 parents 5f53d88 + 1f82935
commit fb872da
Show file tree

Hide file tree

Showing 7 changed files with 7 additions and 11 deletions.
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
@@ -221,7 +221,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
  r = vgic_present;
  break;
  case KVM_CAP_IOEVENTFD:
- case KVM_CAP_DEVICE_CTRL:
  case KVM_CAP_USER_MEMORY:
  case KVM_CAP_SYNC_MMU:
  case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:

diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
@@ -528,7 +528,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
  case KVM_CAP_ENABLE_CAP:
  case KVM_CAP_ONE_REG:
  case KVM_CAP_IOEVENTFD:
- case KVM_CAP_DEVICE_CTRL:
  case KVM_CAP_IMMEDIATE_EXIT:
  case KVM_CAP_SET_GUEST_DEBUG:
  r = 1;

diff --git a/arch/riscv/kvm/vm.c b/arch/riscv/kvm/vm.c
@@ -179,7 +179,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
  r = kvm_riscv_aia_available();
  break;
  case KVM_CAP_IOEVENTFD:
- case KVM_CAP_DEVICE_CTRL:
  case KVM_CAP_USER_MEMORY:
  case KVM_CAP_SYNC_MMU:
  case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:

diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
@@ -213,8 +213,8 @@ int kvm_s390_import_bp_data(struct kvm_vcpu *vcpu,
  else if (dbg->arch.nr_hw_bp > MAX_BP_COUNT)
  return -EINVAL;
 
- bp_data = memdup_user(dbg->arch.hw_bp,
-  sizeof(*bp_data) * dbg->arch.nr_hw_bp);
+ bp_data = memdup_array_user(dbg->arch.hw_bp, dbg->arch.nr_hw_bp,
+   sizeof(*bp_data));
  if (IS_ERR(bp_data))
  return PTR_ERR(bp_data);
 

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
@@ -563,7 +563,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
  case KVM_CAP_ENABLE_CAP:
  case KVM_CAP_S390_CSS_SUPPORT:
  case KVM_CAP_IOEVENTFD:
- case KVM_CAP_DEVICE_CTRL:
  case KVM_CAP_S390_IRQCHIP:
  case KVM_CAP_VM_ATTRIBUTES:
  case KVM_CAP_MP_STATE:

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
@@ -469,7 +469,7 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
  return -E2BIG;
 
  if (cpuid->nent) {
- e = vmemdup_user(entries, array_size(sizeof(*e), cpuid->nent));
+ e = vmemdup_array_user(entries, cpuid->nent, sizeof(*e));
  if (IS_ERR(e))
  return PTR_ERR(e);
 
@@ -513,7 +513,7 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
  return -E2BIG;
 
  if (cpuid->nent) {
- e2 = vmemdup_user(entries, array_size(sizeof(*e2), cpuid->nent));
+ e2 = vmemdup_array_user(entries, cpuid->nent, sizeof(*e2));
  if (IS_ERR(e2))
  return PTR_ERR(e2);
  }

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
@@ -4867,6 +4867,7 @@ static int kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
 #endif
  case KVM_CAP_BINARY_STATS_FD:
  case KVM_CAP_SYSTEM_EVENT_DATA:
+ case KVM_CAP_DEVICE_CTRL:
  return 1;
 #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES
  case KVM_CAP_MEMORY_ATTRIBUTES:
@@ -5256,9 +5257,8 @@ static long kvm_vm_ioctl(struct file *filp,
  goto out;
  if (routing.nr) {
  urouting = argp;
- entries = vmemdup_user(urouting->entries,
- array_size(sizeof(*entries),
- routing.nr));
+ entries = vmemdup_array_user(urouting->entries,
+ routing.nr, sizeof(*entries));
  if (IS_ERR(entries)) {
  r = PTR_ERR(entries);
  goto out;