aboutsummaryrefslogtreecommitdiff
path: root/lib/mpi/mpi-mod.c
diff options
context:
space:
mode:
authorThomas Huth <[email protected]>2023-02-08 15:01:03 +0100
committerPaolo Bonzini <[email protected]>2023-03-16 10:18:06 -0400
commit2def950c63e3f976af87a2606dabe0c9e21c605b (patch)
tree968aaa0c6cf6f28e2df147e842e21ab13c230756 /lib/mpi/mpi-mod.c
parentc5edd753a0bd6243a597f5199c227a50457ee179 (diff)
KVM: arm64: Limit length in kvm_vm_ioctl_mte_copy_tags() to INT_MAX
In case of success, this function returns the amount of handled bytes. However, this does not work for large values: The function is called from kvm_arch_vm_ioctl() (which still returns a long), which in turn is called from kvm_vm_ioctl() in virt/kvm/kvm_main.c. And that function stores the return value in an "int r" variable. So the upper 32-bits of the "long" return value are lost there. KVM ioctl functions should only return "int" values, so let's limit the amount of bytes that can be requested here to INT_MAX to avoid the problem with the truncated return value. We can then also change the return type of the function to "int" to make it clearer that it is not possible to return a "long" here. Fixes: f0376edb1ddc ("KVM: arm64: Add ioctl to fetch/store tags in a guest") Signed-off-by: Thomas Huth <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> Reviewed-by: Gavin Shan <[email protected]> Reviewed-by: Steven Price <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
Diffstat (limited to 'lib/mpi/mpi-mod.c')
0 files changed, 0 insertions, 0 deletions