Re: [PATCH v3 08/11] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall

2019-07-23 Thread Singh, Brijesh
On 7/22/19 12:12 PM, Cfir Cohen wrote: > In addition, it seems that svm_page_enc_status_hc() accepts 'gpa', > 'npages', 'enc' directly from the guest, and so these can take > arbitrary values. A very large 'npages' could lead to an int overflow > in 'gfn_end = gfn_start + npages', making gfn_end

Re: [PATCH v3 08/11] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall

2019-07-23 Thread Singh, Brijesh
On 7/21/19 3:57 PM, David Rientjes wrote: > On Wed, 10 Jul 2019, Singh, Brijesh wrote: > >> diff --git a/Documentation/virtual/kvm/hypercalls.txt >> b/Documentation/virtual/kvm/hypercalls.txt >> index da24c138c8d1..94f0611f4d88 100644 >> --- a/Documentation/virtual/kvm/hypercalls.txt >> +++ b/D

Re: [PATCH v3 08/11] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall

2019-07-22 Thread Cfir Cohen
In addition, it seems that svm_page_enc_status_hc() accepts 'gpa', 'npages', 'enc' directly from the guest, and so these can take arbitrary values. A very large 'npages' could lead to an int overflow in 'gfn_end = gfn_start + npages', making gfn_end < gfn_start. This could an OOB access in the bitm

Re: [PATCH v3 08/11] KVM: X86: Introduce KVM_HC_PAGE_ENC_STATUS hypercall

2019-07-21 Thread David Rientjes
On Wed, 10 Jul 2019, Singh, Brijesh wrote: > diff --git a/Documentation/virtual/kvm/hypercalls.txt > b/Documentation/virtual/kvm/hypercalls.txt > index da24c138c8d1..94f0611f4d88 100644 > --- a/Documentation/virtual/kvm/hypercalls.txt > +++ b/Documentation/virtual/kvm/hypercalls.txt > @@ -141,3 +