summaryrefslogtreecommitdiffstats
path: root/arch
diff options
context:
space:
mode:
authorMarc Zyngier <marc.zyngier@arm.com>2016-02-15 18:04:04 +0100
committerMarc Zyngier <marc.zyngier@arm.com>2016-02-24 12:53:09 +0100
commit1d6a821277aaa0cdd666278aaff93298df313d41 (patch)
tree1e2326fcf2543367d7b7b47166eb2191224940e2 /arch
parentKVM: arm/arm64: vgic: Ensure bitmaps are long enough (diff)
downloadlinux-1d6a821277aaa0cdd666278aaff93298df313d41.tar.xz
linux-1d6a821277aaa0cdd666278aaff93298df313d41.zip
arm/arm64: KVM: Feed initialized memory to MMIO accesses
On an MMIO access, we always copy the on-stack buffer info the shared "run" structure, even if this is a read access. This ends up leaking up to 8 bytes of uninitialized memory into userspace, depending on the size of the access. An obvious fix for this one is to only perform the copy if this is an actual write. Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Diffstat (limited to 'arch')
-rw-r--r--arch/arm/kvm/mmio.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c
index 7f33b2056ae6..0f6600f05137 100644
--- a/arch/arm/kvm/mmio.c
+++ b/arch/arm/kvm/mmio.c
@@ -206,7 +206,8 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
run->mmio.is_write = is_write;
run->mmio.phys_addr = fault_ipa;
run->mmio.len = len;
- memcpy(run->mmio.data, data_buf, len);
+ if (is_write)
+ memcpy(run->mmio.data, data_buf, len);
if (!ret) {
/* We handled the access successfully in the kernel. */