From b3fdeb8b137f232ae32ec43d5afece78f048f8c2 Mon Sep 17 00:00:00 2001 From: Vincent Donnefort Date: Fri, 22 Aug 2025 09:06:19 +0100 Subject: [PATCH] ANDROID: KVM: arm64: Fix hyp_alloc() upper size check The maximum size is of an allocation is bound to the u32 type of alloc in struct chunk_hdr. Bug: 431949921 Bug: 357781595 Reported-by: Hiroyuki Katsura Change-Id: Ifedf1e778afd9c728b654ac223f5f725edc65034 Signed-off-by: Vincent Donnefort --- arch/arm64/kvm/hyp/nvhe/alloc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/arm64/kvm/hyp/nvhe/alloc.c b/arch/arm64/kvm/hyp/nvhe/alloc.c index 491baf86db57..82041e685205 100644 --- a/arch/arm64/kvm/hyp/nvhe/alloc.c +++ b/arch/arm64/kvm/hyp/nvhe/alloc.c @@ -552,6 +552,12 @@ void *hyp_alloc(size_t size) size_t missing_map; int ret = 0; + /* constrained by chunk_hdr *_size types */ + if (size > U32_MAX) { + ret = -E2BIG; + goto end_unlocked; + } + size = ALIGN(size ?: MIN_ALLOC, MIN_ALLOC); hyp_spin_lock(&allocator->lock); @@ -587,9 +593,11 @@ void *hyp_alloc(size_t size) } WARN_ON(chunk_install(chunk, size, last_chunk, allocator)); + end: hyp_spin_unlock(&allocator->lock); +end_unlocked: *(this_cpu_ptr(&hyp_allocator_errno)) = ret; /* Enforce zeroing allocated memory */