From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S933532AbdLRMGY (ORCPT <rfc822;w@1wt.eu>);
        Mon, 18 Dec 2017 07:06:24 -0500
Received: from foss.arm.com ([217.140.101.70]:49400 "EHLO foss.arm.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S933457AbdLRMGM (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 18 Dec 2017 07:06:12 -0500
Subject: Re: [PATCH v4] KVM: Fix stack-out-of-bounds read in write_mmio
To: Paolo Bonzini <pbonzini@redhat.com>, Wanpeng Li <kernellwp@gmail.com>,
        linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>,
        Wanpeng Li <wanpeng.li@hotmail.com>,
        Christoffer Dall <christoffer.dall@linaro.org>
References: <1513302050-14253-1-git-send-email-wanpeng.li@hotmail.com>
 <15b7b9e5-5b11-f20f-0260-5c8b9fc5e111@arm.com>
 <17d27b8d-908b-a740-1d2d-e92a8507f25b@redhat.com>
From: Marc Zyngier <marc.zyngier@arm.com>
Organization: ARM Ltd
Message-ID: <853e8b51-ff54-a48d-8ce8-17060152382b@arm.com>
Date: Mon, 18 Dec 2017 12:06:09 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <17d27b8d-908b-a740-1d2d-e92a8507f25b@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 18/12/17 11:55, Paolo Bonzini wrote:
> On 15/12/2017 12:06, Marc Zyngier wrote:
>> Assuming you address the above:
>>
>> Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
>> Tested-by: Marc Zyngier <marc.zyngier@arm.com>
> 
> Done as follows:
> 
> diff --git a/include/trace/events/kvm.h b/include/trace/events/kvm.h
> index dfd21708694f..0a016bd14c2d 100644
> --- a/include/trace/events/kvm.h
> +++ b/include/trace/events/kvm.h
> @@ -227,7 +227,8 @@
>  		__entry->gpa		= gpa;
>  		__entry->val = 0;
>  		if (val)
> -			memcpy(&__entry->val, val, min(8, len));
> +			memcpy(&__entry->val, val,
> +			       min_t(u32, sizeof(__entry->val), len));
>  	),
>  
>  	TP_printk("mmio %s len %u gpa 0x%llx val 0x%llx",
> 

Looks good to me.

Thanks,

	M.
-- 
Jazz is not dead. It just smells funny...