Vishnu DASA
6f56992a4e
VMCI: Fix integer overflow in VMCI handle arrays ...
commit 1c2eb5b2853c9f513690ba6b71072d8eb65da16a upstream.
The VMCI handle array has an integer overflow in
vmci_handle_arr_append_entry when it tries to expand the array. This can be
triggered from a guest, since the doorbell link hypercall doesn't impose a
limit on the number of doorbell handles that a VM can create in the
hypervisor, and these handles are stored in a handle array.
In this change, we introduce a mandatory max capacity for handle
arrays/lists to avoid excessive memory usage.
Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
Reviewed-by: Adit Ranadive <aditr@vmware.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-21 09:06:03 +02:00
can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
2018-12-01 09:44:19 +01:00
libceph: wait for latest osdmap in ceph_monc_blacklist_add()
2019-03-27 14:13:02 +09:00
firmware /meson
net/ethernet/freescale/fman: fix cross-build error
2018-08-24 13:12:40 +02:00
iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
2019-05-31 06:48:27 -07:00
mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
2019-05-21 18:48:58 +02:00
net/mlx5e: Add a lock on tir list
2019-04-17 08:36:45 +02:00
brcmfmac: Add support for bcm43364 wireless chipset
2018-08-03 07:55:22 +02:00
netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
2018-11-27 16:09:39 +01:00
ebtables: arpreply: Add the standard target sanity check
2018-10-13 09:18:58 +02:00
hwmon: (ina2xx) fix sysfs shunt resistor read access
2018-10-03 17:01:52 -07:00
x86/speculation: Rework SMT state change
2019-05-14 19:19:36 +02:00
sunrpc: use-after-free in svc_process_common()
2019-01-16 22:12:33 +01:00
arm/arm64: smccc-1.1: Handle function result as parameters
2018-10-03 17:01:54 -07:00
appletalk: Fix compile regression
2019-04-20 09:07:54 +02:00
writeback: synchronize sync(2) against cgroup writeback membership switches
2019-05-21 18:49:01 +02:00
bio: fix improper use of smp_mb__before_atomic()
2019-05-31 06:48:11 -07:00
include/linux/bitops.h: sanitize rotate primitives
2019-06-11 12:22:36 +02:00
include/linux/bitrev.h: fix constant bitrev
2019-04-17 08:36:46 +02:00
locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file
2019-05-14 19:19:34 +02:00
block: Fix transfer when chunk sectors exceeds max
2018-07-03 11:23:18 +02:00
bpf: Prevent memory disambiguation attack
2018-12-08 13:05:10 +01:00
cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
2019-06-22 08:17:19 +02:00
clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK
2019-02-27 10:07:01 +01:00
signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
2018-12-21 14:11:29 +01:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
bug.h: work around GCC PR82365 in BUG()
2019-07-10 09:55:44 +02:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
bug.h: work around GCC PR82365 in BUG()
2019-07-10 09:55:44 +02:00
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
2019-06-11 12:22:48 +02:00
cpufreq: Use struct kobj_attribute instead of struct global_attr
2019-03-13 14:04:51 -07:00
evm: Don't deadlock if a crypto algorithm is unavailable
2018-09-26 08:36:37 +02:00
dm: fix to_sector() for 32bit
2019-03-23 13:19:52 +01:00
dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
2018-08-03 07:55:22 +02:00
efi/libstub: Unify command line param parsing
2019-06-11 12:22:45 +02:00
elevator: fix truncation of icq_cache_name
2018-11-10 07:42:48 -08:00
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
2019-06-11 12:22:49 +02:00
drbd: Avoid Clang warning about pointless switch statment
2019-02-12 19:44:56 +01:00
HID: debug: fix the ring buffer implementation
2019-02-15 08:07:39 +01:00
HID: core: move Usage Page concatenation to Main item
2019-05-31 06:48:29 -07:00
mremap: properly flush TLB before releasing the page
2018-10-20 09:51:31 +02:00
hugetlb: use same fault hash key for shared and private mappings
2019-05-31 06:48:12 -07:00
clockevents/drivers/i8253: Add support for PIT shutdown quirk
2018-11-21 09:26:01 +01:00
EVM: Add support for portable signature format
2018-12-01 09:44:26 +01:00
iommu/vt-d: Fix dev iotlb pfsid use
2018-09-09 20:01:24 +02:00
genirq: Avoid summation loops for /proc/stat
2019-04-05 22:29:12 +02:00
time: Introduce jiffies64_to_nsecs()
2018-10-10 08:53:18 +02:00
kasan: add a prototype of task_struct to avoid warning
2019-05-08 07:19:07 +02:00
kbuild: fix asm-offset generation to work with clang
2018-11-23 08:20:35 +01:00
linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
2019-05-10 17:52:09 +02:00
drivers: core: Remove glue dirs from sysfs earlier
2019-02-06 17:33:29 +01:00
x86/kprobes: Verify stack frame on kretprobe
2019-04-27 09:34:44 +02:00
kvm: fix warning for CONFIG_HAVE_KVM_EVENTFD builds
2018-05-30 07:50:30 +02:00
ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
2018-07-17 11:37:52 +02:00
net: core: another layer of lists, around PF_MEMALLOC skb handling
2019-05-21 18:48:55 +02:00
memcg: make it work on sparse non-0-node systems
2019-06-11 12:22:42 +02:00
bpf: convert htab map to hlist_nulls
2019-05-16 19:43:40 +02:00
mm: make page ref count overflow check tighter and more explicit
2019-06-11 12:22:45 +02:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
modules: mark __inittest/__exittest as __maybe_unused
2018-11-23 08:20:35 +01:00
platform-msi: Free descriptors in platform_msi_domain_free()
2019-01-09 16:16:43 +01:00
net: Add header for usage of fls64()
2019-02-23 09:05:58 +01:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
of: fix clang -Wunsequenced for be32_to_cpu()
2019-05-25 18:26:47 +02:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum
2019-05-25 18:26:53 +02:00
r8169: add support for NCube 8168 network card
2018-09-15 09:42:56 +02:00
perf/x86: Add check_period PMU callback
2019-02-20 10:18:31 +01:00
include/linux/pfn_t.h: force '~' to be parsed as an unary operator
2018-12-01 09:44:25 +01:00
fs: prevent page refcount overflow in pipe_buf_get
2019-06-11 12:22:45 +02:00
posix-timers: Sanitize overrun handling
2018-11-10 07:43:01 -08:00
power: remove possible deadlock when unregistering power_supply
2018-10-03 17:01:43 -07:00
device property: Fix the length used in PROPERTY_ENTRY_STRING()
2019-03-23 13:19:50 +01:00
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
2019-01-09 16:16:42 +01:00
x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
2019-05-14 19:19:34 +02:00
pwm: Fix deadlock warning when removing PWM device
2019-06-22 08:17:17 +02:00
bpf: convert htab map to hlist_nulls
2019-05-16 19:43:40 +02:00
rcu: locking and unlocking need to always be at least barriers
2019-06-11 12:22:47 +02:00
include/linux/relay.h: fix percpu annotation in struct rchan
2019-04-05 22:29:06 +02:00
reset: remove remaining WARN_ON() in <linux/reset.h>
2018-12-08 13:05:09 +01:00
rhashtable: reorganize struct rhashtable layout
2018-10-18 09:13:25 +02:00
tracing: kdb: Fix ftdump to not sleep
2019-04-05 22:29:05 +02:00
x86/speculation: Add prctl() control for indirect branch speculation
2019-05-14 19:19:39 +02:00
serial: core: Make sure compiler barfs for 16-byte earlycon names
2018-08-03 07:55:25 +02:00
net: create skb_gso_validate_mac_len()
2019-02-20 10:18:28 +01:00
slub: make ->cpu_partial unsigned int
2018-10-03 17:01:50 -07:00
smpboot: Place the __percpu annotation correctly
2019-05-31 06:48:17 -07:00
lib/string.c: implement a basic bcmp
2019-04-17 08:36:39 +02:00
include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
2019-04-20 09:07:54 +02:00
x86/speculation/l1tf: Limit swap file size to MAX_PA/2
2018-08-15 18:14:45 +02:00
proc: Fix proc_sys_prune_dcache to hold a sb reference
2018-08-15 18:14:43 +02:00
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
2018-09-05 09:20:10 +02:00
TC: Set DMA masks for devices
2018-11-13 11:17:02 -08:00
tcp: limit payload size of sacked skbs
2019-06-17 19:53:32 +02:00
fork: unconditionally clear stack on fork
2018-08-09 12:18:00 +02:00
new helper: uaccess_kernel()
2018-11-27 16:09:41 +01:00
USB: core: Fix bug caused by duplicate interface PM usage counter
2019-05-08 07:19:08 +02:00
Replace magic for trusting the secondary keyring with #define
2018-09-09 20:01:23 +02:00
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
2019-04-17 08:36:47 +02:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
VMCI: Fix integer overflow in VMCI handle arrays
2019-07-21 09:06:03 +02:00
workqueue: avoid clang warning
2018-12-05 19:42:42 +01:00
