Commit 2558258d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm 

Pull kvm fix from Paolo Bonzini:
 "Fix for a possible out-of-bounds access"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
parents 50987bec 04c4f2ee

arch/x86/kvm/vmx/vmx.c

+5 −5
Original line number Diff line number Diff line
@@ -6027,19 +6027,19 @@ static int __vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath) 
	     exit_reason.basic != EXIT_REASON_PML_FULL &&

	     exit_reason.basic != EXIT_REASON_APIC_ACCESS &&

	     exit_reason.basic != EXIT_REASON_TASK_SWITCH)) {

		int ndata = 3;



		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;

		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;

		vcpu->run->internal.ndata = 3;

		vcpu->run->internal.data[0] = vectoring_info;

		vcpu->run->internal.data[1] = exit_reason.full;

		vcpu->run->internal.data[2] = vcpu->arch.exit_qualification;

		if (exit_reason.basic == EXIT_REASON_EPT_MISCONFIG) {

			vcpu->run->internal.ndata++;

			vcpu->run->internal.data[3] =

			vcpu->run->internal.data[ndata++] =

				vmcs_read64(GUEST_PHYSICAL_ADDRESS);

		}

		vcpu->run->internal.data[vcpu->run->internal.ndata++] =

			vcpu->arch.last_vmentry_cpu;

		vcpu->run->internal.data[ndata++] = vcpu->arch.last_vmentry_cpu;

		vcpu->run->internal.ndata = ndata;

		return 0;

	}