George Kennedy 055891397f VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF ... [ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ] The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: a1d88436d5 ("VMCI: Fix two UVA mapping bugs") Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: George Kennedy <george.kennedy@oracle.com> Reviewed-by: Vishnu Dasa <vdasa@vmware.com> Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-10 09:33:33 +01:00
..
Kconfig	VMCI: Add support for ARM64	2022-04-24 17:32:14 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
vmci_context.c	misc: vmw_vmci: replace usage of found with dedicated list iterator variable	2022-04-24 17:24:09 +02:00
vmci_context.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_datagram.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_datagram.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_doorbell.c	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct	2021-04-05 12:29:31 +02:00
vmci_doorbell.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_driver.c	vsock/vmci: make vmci_vsock_cb_host_called static	2019-11-20 12:39:29 -08:00
vmci_driver.h	vsock/vmci: register vmci_transport only when VMCI guest/host are active	2019-11-14 18:12:18 -08:00
vmci_event.c	misc: vmw_vmci: Switch to kvfree_rcu() API	2021-12-21 10:25:15 +01:00
vmci_event.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_guest.c	VMCI: Use threaded irqs instead of tasklets	2023-01-24 07:24:39 +01:00
vmci_handle_array.c	VMCI: Fix integer overflow in VMCI handle arrays	2019-06-21 16:04:05 +02:00
vmci_handle_array.h	VMCI: Fix integer overflow in VMCI handle arrays	2019-06-21 16:04:05 +02:00
vmci_host.c	VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF	2023-03-10 09:33:33 +01:00
vmci_queue_pair.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
vmci_queue_pair.h	misc/vmw_vmci: fix typo	2021-01-26 19:18:01 +01:00
vmci_resource.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_resource.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_route.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00
vmci_route.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321	2019-06-05 17:37:05 +02:00