KVM: Harden copying of userspace-array against overflow

kvm_main.c utilizes vmemdup_user() and array_size() to copy a userspace
array. Currently, this does not check for an overflow.

Use the new wrapper vmemdup_array_user() to copy the array more safely.

Note, KVM explicitly checks the number of entries before duplicating the
array, i.e. adding the overflow check should be a glorified nop.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Link: https://lore.kernel.org/r/20231102181526.43279-4-pstanner@redhat.com
[sean: call out that KVM pre-checks the number of entries]
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index b744eddecbc075ba04cebcf09f2060314287dfdb..e76d49daa4701306b6c67cf64666cccb34cf86f4 100644 (file)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -5262,9 +5262,8 @@ static long kvm_vm_ioctl(struct file *filp,
                        goto out;
                if (routing.nr) {
                        urouting = argp;
-                       entries = vmemdup_user(urouting->entries,
-                                              array_size(sizeof(*entries),
-                                                         routing.nr));
+                       entries = vmemdup_array_user(urouting->entries,
+                                                    routing.nr, sizeof(*entries));
                        if (IS_ERR(entries)) {
                                r = PTR_ERR(entries);
                                goto out;