From nobody Mon Dec 1 22:02:37 2025 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26DC825776 for ; Thu, 27 Nov 2025 00:11:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764202307; cv=none; b=VJf+SksFNMx6qC52uQbxMdZ0PIelGvLGRD4Ge0LmAdjt1zDOmHbqoj8IMVAok/OY5PZSWwf3BMDe7j7grTtGFdOgwt5HdKYN/h9vK8nYH5KjOu1QmMtQuqzwZPf0uJ7MdQ+AW7R+gqnsJ+MGucvcjTUgH05ds+8oCRUE5z97mbI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764202307; c=relaxed/simple; bh=U/Qt0fwjclNcK05dUhaILvGCRr9iYZXeQ5XH9CgeTa4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IiEFVWVAtASat0gTvgAhn3gNEI5Ru03mk53BzdOmqsyf4m9yY1V8lCf5B7aHfjsB3Hx+jJyz9tg/FuGVfQJbfZ5o0XUYxyPCUJQLncPLgTeioKxnt/0/X8eFx1AHtenvTgIn8C+aX3/3vbpS9590yyr31epKxoBhVZEOYF/WWOA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Zb2sdPql; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Zb2sdPql" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-477b198f4bcso1357915e9.3 for ; Wed, 26 Nov 2025 16:11:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764202304; x=1764807104; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Npjor9zv99QfGBBPEe2AIBP/GoEg83/ki3BWEuhSPRU=; b=Zb2sdPqlx6Gf9ieMKb0TEUN+rBWJ2Or1Mgff4ydNYIBa8EFhBeAoKdRAtw7NLtxAhC QE1wJ46J/HawHjPlZJBtAQdPBJmiKdbzFBpJVZ6G0ZnGuz2SPJaB7C1oeFrpV5zF3plv ZKDva1m3lGXZevKUrENEmnklhitb8tmGLgQ89e7dgK6xCw8I6aUZPNQUPfR4/yHFzfDr wKHK6qFFM7uSUN6TvStccpJGkunQ06Qbz2EvltXS3DqU6KGa9yant2tE1qhONW0QpOp6 z1yABfy/WUrmgrchntkuZBXLr33+xOWlKCTYW3AhP6Dkc5GR6Uk+YaeYziINAYfLnUnF dRKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764202304; x=1764807104; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Npjor9zv99QfGBBPEe2AIBP/GoEg83/ki3BWEuhSPRU=; b=ipokTGascyas6cdWaebSNtRzkbD/10fkOEUnW9hyKF8rdfvvEJvfNijCy1UnYMWEhD YIxj2Fjy5MFJyFQfXbY982/RGK8etWiaPod7JGZl9iGnqdjQ63r26OUsP5wabIlf8lYe Hl0gq1JsC7hnDolCG8q7PORGW9yptJuewmJpb6WVZUiM/pwDZImUv4EOJeq33EuNbxod WsgJfHS2uoWr4l3KIO2Nx6/QxcxfGOpafyBYhwarcxxooZy+P/9ycjfRsKWpFjEzYV6j 6eXbuRCEczAq25uFYJHdQWtFn7E8B2SZpV9KvqEuxmW+iOJei1+3NUZwTT40O8xUyamN DRpg== X-Forwarded-Encrypted: i=1; AJvYcCVoBerXFwxyPWGTalvLNetFD0k5GbllhR2HfOOQpmUl/vc0+knLo1e6EHJQalCNFnduGQTKvXwHZb47Xhs=@vger.kernel.org X-Gm-Message-State: AOJu0YwIcZOaDOO5okgE9RIg5xsFEq5mVg/4m66v/qW5Gp6qXGGhDdOH 8sb4oS19AIAl5tvn2zt+q9MvxF7Bd6/+Ye4IYf4GZm+QxRE5BLdqxyRC X-Gm-Gg: ASbGncu1Kw8ofl6QKP8pFvkbsQSwbtC7yAAYVnCA2xzgLl9qnoojN2eUtHhrLdlNYp5 /ax8UiOnprICy5dUe3qBu4WG9nJVxMKDkE9TLzHGsWUJJ+wgrV43PmY9OuIprnqrkkMfIHgIH9U orZzIN4DSQ7Sq7tyEqEg+S993Bb3xTnWnzg7gitEAx1kAnZr/W2YV9Rnk5nGS0T9a/WiX7itLds 5yI3HbOwedgCqMPSCm9Crng9sz8pu7fpefVtT38wn905suB3s7h3BpGtTYOE2VMRgokl7T2PH3o C+MREWWQfmoy3eGdAzrbMBLNIIZcpoqs5PjJ8R9D1X4gLp5IGocH+vQwOFZ5B/Cdx6x1INsxExy Z0coxWFlu/AZ+DMxY8epTS57yurWTTmQYduXiE9CMB95lAAQjBY6iydjSvIPyKXCNvQNL51MfLA t6ibS2inrOqxsHalkPEltdXGUcxCziFZK64q6UZYb3OtseeD+1f1L4LieVCWT6zVP+7x/ZImbE X-Google-Smtp-Source: AGHT+IFfNXdmYVNGq0Jx4N8NyOWnTBj4yEXNWpHEsVPE37ptyjckjYJVFSpElqvAAd7D1yUotu9bSQ== X-Received: by 2002:a05:600c:4e87:b0:46d:a04:50c6 with SMTP id 5b1f17b1804b1-477c01ebc76mr206612645e9.30.1764202304263; Wed, 26 Nov 2025 16:11:44 -0800 (PST) Received: from localhost.localdomain ([197.153.73.32]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4790b0cc1d6sm65937725e9.12.2025.11.26.16.11.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Nov 2025 16:11:43 -0800 (PST) From: redacherkaoui To: pbonzini@redhat.com Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, redahack12-glitch , REDA CHERKAOUI Subject: [PATCH] KVM: coalesced_mmio: Fix out-of-bounds write in coalesced_mmio_write() Date: Thu, 27 Nov 2025 01:11:32 +0100 Message-ID: <20251127001132.13704-1-redacherkaoui67@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: redahack12-glitch The coalesced MMIO ring stores each entry's MMIO payload in an 8-byte fixed-size buffer (data[8]). However, coalesced_mmio_write() copies the payload using memcpy(..., len) without verifying that 'len' does not exceed the buffer size. A malicious or buggy caller could therefore trigger a write past the end of the data[] array and corrupt adjacent kernel memory inside the ring page. Add a bounds check to reject writes where len > sizeof(data). Signed-off-by: REDA CHERKAOUI --- virt/kvm/coalesced_mmio.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index 375d6285475e..4f302713de9e 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -68,6 +68,14 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu, =20 /* copy data in first free entry of the ring */ =20 + /* Prevent overflow of the fixed 8-byte data[] field */ + if (len > sizeof(ring->coalesced_mmio[insert].data)) { + spin_unlock(&dev->kvm->ring_lock); + pr_warn_ratelimited("KVM: coalesced MMIO write too large (%d > %zu)\n", + len, sizeof(ring->coalesced_mmio[insert].data)); + return -E2BIG; + } + ring->coalesced_mmio[insert].phys_addr =3D addr; ring->coalesced_mmio[insert].len =3D len; memcpy(ring->coalesced_mmio[insert].data, val, len); --=20 2.43.0