Vishnu DASA
6f56992a4e
VMCI: Fix integer overflow in VMCI handle arrays ...
commit 1c2eb5b2853c9f513690ba6b71072d8eb65da16a upstream.
The VMCI handle array has an integer overflow in
vmci_handle_arr_append_entry when it tries to expand the array. This can be
triggered from a guest, since the doorbell link hypercall doesn't impose a
limit on the number of doorbell handles that a VM can create in the
hypervisor, and these handles are stored in a handle array.
In this change, we introduce a mandatory max capacity for handle
arrays/lists to avoid excessive memory usage.
Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
Reviewed-by: Adit Ranadive <aditr@vmware.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-21 09:06:03 +02:00
drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
2017-06-24 07:11:16 +02:00
cxl: Fix wrong comparison in cxl_adapter_context_get()
2018-09-09 20:01:20 +02:00
eeprom: at24: add support for 24c2048
2019-02-20 10:18:25 +01:00
genwqe: Prevent an integer overflow in the ioctl
2019-06-11 12:22:48 +02:00
ibmasm: don't write out of bounds in read handler
2018-07-17 11:37:51 +02:00
mei: bus: type promotion bug in mei_nfc_if_version()
2018-09-26 08:36:40 +02:00
misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
2018-12-05 19:42:41 +01:00
drivers/misc/sgi-gru: fix Spectre v1 vulnerability
2018-11-27 16:09:41 +01:00
misc: ti-st: Fix memory leak in the error path of probe()
2018-09-19 22:47:13 +02:00
VMCI: Fix integer overflow in VMCI handle arrays
2019-07-21 09:06:03 +02:00
misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
2018-11-27 16:09:41 +01:00
scsi: ses: don't get power status of SES device slot on probe
2018-03-22 09:17:48 +01:00
misc: hmc6352: fix potential Spectre v1
2018-09-26 08:36:35 +02:00
Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
2019-06-22 08:17:19 +02:00
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
lkdtm: turn off kcov for lkdtm_rodata_do_nothing:
2018-03-22 09:17:49 +01:00
misc: panel: properly restore atomic counter on error path
2017-11-18 11:22:25 +01:00
tsl2550: fix lux1_input error in low light
2018-10-03 17:01:41 -07:00
misc: vexpress: Off by one in vexpress_syscfg_exec()
2019-02-15 08:07:37 +01:00
vmw_balloon: include asm/io.h
2018-09-29 03:07:35 -07:00
6f56992a4e