Re: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2

[Paolo Bonzini]

On 10/27/23 20:21, Sean Christopherson wrote:

+               if (ioctl == KVM_SET_USER_MEMORY_REGION)
+                       size = sizeof(struct kvm_userspace_memory_region);

This also needs a memset(&mem, 0, sizeof(mem)), otherwise the 
out-of-bounds access of the commit message becomes a kernel stack read.

Probably worth adding a check on valid flags here.

Paolo

+               else
+                       size = sizeof(struct kvm_userspace_memory_region2);
+
+               /* Ensure the common parts of the two structs are identical. */
+               SANITY_CHECK_MEM_REGION_FIELD(slot);
+               SANITY_CHECK_MEM_REGION_FIELD(flags);
+               SANITY_CHECK_MEM_REGION_FIELD(guest_phys_addr);
+               SANITY_CHECK_MEM_REGION_FIELD(memory_size);
+               SANITY_CHECK_MEM_REGION_FIELD(userspace_addr);