KVM: PPC: Book3S HV: Fix H_REGISTER_VPA VPA size validation
authorNicholas Piggin <npiggin@gmail.com>
Sun, 13 Aug 2017 01:33:38 +0000 (11:33 +1000)
committerPaul Mackerras <paulus@ozlabs.org>
Thu, 31 Aug 2017 02:36:44 +0000 (12:36 +1000)
KVM currently validates the size of the VPA registered by the client
against sizeof(struct lppaca), however we align (and therefore size)
that struct to 1kB to avoid crossing a 4kB boundary in the client.

PAPR calls for sizes >= 640 bytes to be accepted. Hard code this with
a comment.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
arch/powerpc/kvm/book3s_hv.c

index 359c79cdf0cc821d87a4e4322177294648b42ee3..1182cfd7985715aef69f3ef04370d6aba835b138 100644 (file)
@@ -485,7 +485,13 @@ static unsigned long do_h_register_vpa(struct kvm_vcpu *vcpu,
 
        switch (subfunc) {
        case H_VPA_REG_VPA:             /* register VPA */
-               if (len < sizeof(struct lppaca))
+               /*
+                * The size of our lppaca is 1kB because of the way we align
+                * it for the guest to avoid crossing a 4kB boundary. We only
+                * use 640 bytes of the structure though, so we should accept
+                * clients that set a size of 640.
+                */
+               if (len < 640)
                        break;
                vpap = &tvcpu->arch.vpa;
                err = 0;