Commit 4ea9439f authored by David Woodhouse's avatar David Woodhouse Committed by Paolo Bonzini
Browse files

KVM: x86/xen: Validate port number in SCHEDOP_poll 



We shouldn't allow guests to poll on arbitrary port numbers off the end
of the event channel table.

Fixes: 1a65105a ("KVM: x86/xen: handle PV spinlocks slowpath")
[dwmw2: my bug though; the original version did check the validity as a
 side-effect of an idr_find() which I ripped out in refactoring.]
Reported-by: default avatarMichal Luczaj <mhal@rbox.co>
Signed-off-by: default avatarDavid Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: default avatarSean Christopherson <seanjc@google.com>
Cc: stable@kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent d72cf8ff

arch/x86/kvm/xen.c

+12 −8
Original line number Diff line number Diff line
@@ -954,6 +954,14 @@ static int kvm_xen_hypercall_complete_userspace(struct kvm_vcpu *vcpu) 
	return kvm_xen_hypercall_set_result(vcpu, run->xen.u.hcall.result);

}



static inline int max_evtchn_port(struct kvm *kvm)

{

	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)

		return EVTCHN_2L_NR_CHANNELS;

	else

		return COMPAT_EVTCHN_2L_NR_CHANNELS;

}



static bool wait_pending_event(struct kvm_vcpu *vcpu, int nr_ports,

			       evtchn_port_t *ports)

{
@@ -1042,6 +1050,10 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, 
			*r = -EFAULT;

			goto out;

		}

		if (ports[i] >= max_evtchn_port(vcpu->kvm)) {

			*r = -EINVAL;

			goto out;

		}

	}



	if (sched_poll.nr_ports == 1)
@@ -1297,14 +1309,6 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) 
	return 0;

}



static inline int max_evtchn_port(struct kvm *kvm)

{

	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)

		return EVTCHN_2L_NR_CHANNELS;

	else

		return COMPAT_EVTCHN_2L_NR_CHANNELS;

}



static void kvm_xen_check_poller(struct kvm_vcpu *vcpu, int port)

{

	int poll_evtchn = vcpu->arch.xen.poll_evtchn;