kernel/drivers/misc/vmw_vmci/vmci_handle_array.c, branch linux-5.1.yHosts the 0x221E linux distro kernel.https://universe.0xinfinity.dev/distro/kernel/atom?h=linux-5.1.y2019-07-14T06:09:51ZVMCI: Fix integer overflow in VMCI handle arrays2019-07-14T06:09:51ZVishnu DASAvdasa@vmware.com2019-05-24T15:13:10Zurn:sha1:95688f33cb29efe90bb31b61e5d604e60ed35498
commit 1c2eb5b2853c9f513690ba6b71072d8eb65da16a upstream.
The VMCI handle array has an integer overflow in
vmci_handle_arr_append_entry when it tries to expand the array. This can be
triggered from a guest, since the doorbell link hypercall doesn't impose a
limit on the number of doorbell handles that a VM can create in the
hypervisor, and these handles are stored in a handle array.
In this change, we introduce a mandatory max capacity for handle
arrays/lists to avoid excessive memory usage.
Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
Reviewed-by: Adit Ranadive <aditr@vmware.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
VMCI: handle array implementation.2013-01-09T00:15:55ZGeorge Zhanggeorgezhang@vmware.com2013-01-08T23:54:39Zurn:sha1:b484b26cc7be6ccf3676deb5e03aed2609ee9a40
VMCI handle code adds support for dynamic arrays that will grow if they need to.
Signed-off-by: George Zhang <georgezhang@vmware.com>
Acked-by: Andy king <acking@vmware.com>
Acked-by: Dmitry Torokhov <dtor@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>