[PATCH] KVM: coalesced_mmio: Sanity check the size of writes

[Wenmei Wang]

Each ring entry has a fixed 8-byte data buffer, but the write path only
checks that the access falls within the zone, not that it fits in the
buffer.  All in-tree users of the MMIO bus cap accesses at 8 bytes, so
this cannot be triggered today.  Reject oversized writes anyway instead
of trusting every caller to uphold that limit.

Found by reading the code.

Signed-off-by: Wenmei Wang <wangwenmei0618@xxxxxxx>
---
 virt/kvm/coalesced_mmio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index 3b5430036cae..fce38f1c8054 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -53,6 +53,9 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
 	if (!coalesced_mmio_in_range(dev, addr, len))
 		return -EOPNOTSUPP;
 
+	if (len > sizeof_field(struct kvm_coalesced_mmio, data))
+		return -EOPNOTSUPP;
+
 	spin_lock(&dev->kvm->ring_lock);
 
 	/*
-- 
2.25.1