KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots

The userspace can trigger "vmalloc size %lu allocation failure: exceeds
total pages" via the KVM_SET_USER_MEMORY_REGION ioctl.

This silences the warning by checking the limit before calling vzalloc()
and returns ENOMEM if failed.

This does not call underlying valloc helpers as __vmalloc_node() is only
exported when CONFIG_TEST_VMALLOC_MODULE and __vmalloc_node_range() is
not exported at all.

Spotted by syzkaller.

Signed-off-by: Alexey Kardashevskiy <[email protected]>
[mpe: Use 'size' for the variable rather than 'cb']
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 98e90bdf1f2714ec7074e2711568c3b479cb0775..7986911b873c040efb2df20ef77e35c58f350906 100644 (file)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -4872,8 +4872,12 @@ static int kvmppc_core_prepare_memory_region_hv(struct kvm *kvm,
        unsigned long npages = mem->memory_size >> PAGE_SHIFT;
 
        if (change == KVM_MR_CREATE) {
-               slot->arch.rmap = vzalloc(array_size(npages,
-                                         sizeof(*slot->arch.rmap)));
+               unsigned long size = array_size(npages, sizeof(*slot->arch.rmap));
+
+               if ((size >> PAGE_SHIFT) > totalram_pages())
+                       return -ENOMEM;
+
+               slot->arch.rmap = vzalloc(size);
                if (!slot->arch.rmap)
                        return -ENOMEM;
        }