Quentin Perret 0957aec081 ANDROID: KVM: arm64: Fix ToCToU issue when refilling the hyp memcache ...

Xiling reports that the hypervisor dereferences the host memcache struct
twice when refilling its own memcache. This allows the host to change its
memcache head after it has been admitted and before it is consumed,
leading to an arbitrary write in hypervisor memory.

Fix this by copying the host memcache on the stack before starting to
refill hence guaranteeing its stability.

Bug: 228435321
Reported-by: Xiling Gong <xiling@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: Ib7c5db203e4a4a7f27eb9f0c0083f4b5c726b4d9

2022-04-08 12:35:02 +00:00

..

alpha

alpha: enable GENERIC_PCI_IOMAP unconditionally

2021-09-19 10:37:00 -07:00

arc

signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)

2021-11-25 09:49:06 +01:00

arm

Merge 5.15.30 into android13-5.15

2022-03-19 14:36:07 +01:00

arm64

ANDROID: KVM: arm64: Fix ToCToU issue when refilling the hyp memcache

2022-04-08 12:35:02 +00:00

csky

uaccess: fix integer overflow on access_ok()

2022-03-28 09:58:45 +02:00

h8300

Merge branch 'akpm' (patches from Andrew)

2021-09-08 12:55:35 -07:00

hexagon

uaccess: fix integer overflow on access_ok()

2022-03-28 09:58:45 +02:00

ia64

PCI/sysfs: Find shadow ROM before static attribute initialization

2022-02-01 17:27:05 +01:00

m68k

m68k: fix access_ok for coldfire

2022-03-28 09:58:46 +02:00

microblaze

uaccess: fix integer overflow on access_ok()

2022-03-28 09:58:45 +02:00

mips

MIPS: smp: fill in sibling and core maps earlier

2022-03-19 13:47:48 +01:00

nds32

nds32: fix access_ok() checks in get/put_user

2022-03-28 09:58:46 +02:00

nios2

nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST

2021-10-27 09:29:07 -05:00

openrisc

openrisc: Add clone3 ABI wrapper

2022-01-27 11:04:10 +01:00

parisc

parisc/unaligned: Fix ldw() and stw() unalignment handlers

2022-03-02 11:47:49 +01:00

powerpc

BACKPORT: FROMLIST: mm: enable speculative fault handling for supported file types.

2022-03-23 11:32:19 -07:00

riscv

riscv: dts: k210: fix broken IRQs on hart1

2022-03-16 14:23:46 +01:00

s390

Merge 5.15.27 into android-5.15

2022-03-17 14:02:09 +01:00

sh

Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH

2022-01-27 11:05:21 +01:00

sparc

signal: Replace force_fatal_sig with force_exit_sig when in doubt

2021-11-25 09:49:07 +01:00

um

block: drop unused includes in <linux/genhd.h>

2022-03-16 14:23:46 +01:00

x86

Revert "Revert "ANDROID: GKI: Change UCLAMP_BUCKETS_COUNT to 20""

2022-04-06 08:31:37 -07:00

xtensa

xtensa: xtfpga: Try software restart before simulating CPU reset

2021-10-05 12:19:05 -07:00

.gitignore

…

Kconfig

FROMLIST: tracing: Add register read/write tracing support

2022-01-18 16:54:12 +00:00