Patchwork [3.5.y.z,extended,stable] Patch "KVM: x86: fix for buffer overflow in handling of" has been added to staging queue

mail settings
Submitter Luis Henriques
Date April 11, 2013, 9:09 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/235638/
State New
Headers show


Luis Henriques - April 11, 2013, 9:09 a.m.
This is a note to let you know that I have just added a patch titled

    KVM: x86: fix for buffer overflow in handling of

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 9ebdfca37460b564bc58ca0a50a477fba06250e0 Mon Sep 17 00:00:00 2001
From: Andy Honig <>
Date: Mon, 11 Mar 2013 09:34:52 -0700
Subject: [PATCH] KVM: x86: fix for buffer overflow in handling of

commit c300aa64ddf57d9c5d9c898a64b36877345dd4a9 upstream.

If the guest sets the GPA of the time_page so that the request to update the
time straddles a page then KVM will write onto an incorrect page.  The
write is done byusing kmap atomic to get a pointer to the page for the time
structure and then performing a memcpy to that page starting at an offset
that the guest controls.  Well behaved guests always provide a 32-byte aligned
address, however a malicious guest could use this to corrupt host kernel

Tested: Tested against kvmclock unit test.

Signed-off-by: Andrew Honig <>
Signed-off-by: Marcelo Tosatti <>
Signed-off-by: Luis Henriques <>
 arch/x86/kvm/x86.c | 5 +++++
 1 file changed, 5 insertions(+)



diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8b6fbee..ad5cf4b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1618,6 +1618,11 @@  int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
 		/* ...but clean it before doing the actual write */
 		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);

+		/* Check that the address is 32-byte aligned. */
+		if (vcpu->arch.time_offset &
+				(sizeof(struct pvclock_vcpu_time_info) - 1))
+			break;
 		vcpu->arch.time_page =
 				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);