Tianyu Lan 4030b4c585 x86/hyper-v: Fix overflow bug in fill_gva_list() ... When the 'start' parameter is >= 0xFF000000 on 32-bit systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems, fill_gva_list() gets into an infinite loop. With such inputs, 'cur' overflows after adding HV_TLB_FLUSH_UNIT and always compares as less than end. Memory is filled with guest virtual addresses until the system crashes. Fix this by never incrementing 'cur' to be larger than 'end'. Reported-by: Jong Hyun Park <park.jonghyun@yonsei.ac.kr> Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: 2ffd9e33ce ("x86/hyper-v: Use hypercall for remote TLB flush") Signed-off-by: Ingo Molnar <mingo@kernel.org>		2019-09-02 19:57:19 +02:00
..
hv_apic.c	x86/hyper-v: Implement EOI assist	2019-04-16 12:28:23 +02:00
hv_init.c	x86/hyper-v: Zero out the VP ASSIST PAGE on allocation	2019-07-19 09:48:15 +02:00
hv_spinlock.c	x86/hyperv: Make hv_vcpu_is_preempted() visible	2019-04-19 17:58:57 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
mmu.c	x86/hyper-v: Fix overflow bug in fill_gva_list()	2019-09-02 19:57:19 +02:00
nested.c	x86/hyper-v: Add HvFlushGuestAddressList hypercall support	2018-12-21 11:28:39 +01:00