Commit 2e3272bc authored by Alexander Graf's avatar Alexander Graf Committed by Paolo Bonzini
Browse files

KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() 



In the next patch we want to introduce a second caller to
set_msr_filter() which constructs its own filter list on the stack.
Refactor the original function so it takes it as argument instead of
reading it through copy_from_user().

Signed-off-by: default avatarAlexander Graf <graf@amazon.com>
Message-Id: <20221017184541.2658-3-graf@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent ed51862f

arch/x86/kvm/x86.c

+17 −14
Original line number Diff line number Diff line
@@ -6442,26 +6442,22 @@ static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter, 
	return 0;

}



static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)

static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm,

				       struct kvm_msr_filter *filter)

{

	struct kvm_msr_filter __user *user_msr_filter = argp;

	struct kvm_x86_msr_filter *new_filter, *old_filter;

	struct kvm_msr_filter filter;

	bool default_allow;

	bool empty = true;

	int r = 0;

	u32 i;



	if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))

		return -EFAULT;



	if (filter.flags & ~KVM_MSR_FILTER_DEFAULT_DENY)

	if (filter->flags & ~KVM_MSR_FILTER_DEFAULT_DENY)

		return -EINVAL;



	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++)

		empty &= !filter.ranges[i].nmsrs;

	for (i = 0; i < ARRAY_SIZE(filter->ranges); i++)

		empty &= !filter->ranges[i].nmsrs;



	default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY);

	default_allow = !(filter->flags & KVM_MSR_FILTER_DEFAULT_DENY);

	if (empty && !default_allow)

		return -EINVAL;
@@ -6469,8 +6465,8 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) 
	if (!new_filter)

		return -ENOMEM;



	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) {

		r = kvm_add_msr_filter(new_filter, &filter.ranges[i]);

	for (i = 0; i < ARRAY_SIZE(filter->ranges); i++) {

		r = kvm_add_msr_filter(new_filter, &filter->ranges[i]);

		if (r) {

			kvm_free_msr_filter(new_filter);

			return r;
@@ -6915,9 +6911,16 @@ long kvm_arch_vm_ioctl(struct file *filp, 
	case KVM_SET_PMU_EVENT_FILTER:

		r = kvm_vm_ioctl_set_pmu_event_filter(kvm, argp);

		break;

	case KVM_X86_SET_MSR_FILTER:

		r = kvm_vm_ioctl_set_msr_filter(kvm, argp);

	case KVM_X86_SET_MSR_FILTER: {

		struct kvm_msr_filter __user *user_msr_filter = argp;

		struct kvm_msr_filter filter;



		if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))

			return -EFAULT;



		r = kvm_vm_ioctl_set_msr_filter(kvm, &filter);

		break;

	}

	default:

		r = -ENOTTY;

	}