Each ring entry has a fixed 8-byte data buffer, but the write path only checks that the access falls within the zone, not that it fits in the buffer. All in-tree users of the MMIO bus cap accesses at 8 bytes, so this cannot be triggered today. Reject oversized writes anyway instead of trusting every caller to uphold that limit. Found by reading the code. Signed-off-by: Wenmei Wang --- virt/kvm/coalesced_mmio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index 3b5430036cae..fce38f1c8054 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -53,6 +53,9 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu, if (!coalesced_mmio_in_range(dev, addr, len)) return -EOPNOTSUPP; + if (len > sizeof_field(struct kvm_coalesced_mmio, data)) + return -EOPNOTSUPP; + spin_lock(&dev->kvm->ring_lock); /* -- 2.25.1