lkml.org 
[lkml]   [2020]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 113/114] KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    Date
    From: Jim Mattson <jmattson@google.com>

    commit c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 upstream.

    Bank_num is a one-based count of banks, not a zero-based index. It
    overflows the allocated space only when strictly greater than
    KVM_MAX_MCE_BANKS.

    Fixes: a9e38c3e01ad ("KVM: x86: Catch potential overrun in MCE setup")
    Signed-off-by: Jue Wang <juew@google.com>
    Signed-off-by: Jim Mattson <jmattson@google.com>
    Reviewed-by: Peter Shier <pshier@google.com>
    Message-Id: <20200511225616.19557-1-jmattson@google.com>
    Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kvm/x86.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -3214,7 +3214,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(
    unsigned bank_num = mcg_cap & 0xff, bank;

    r = -EINVAL;
    - if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
    + if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
    goto out;
    if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
    goto out;

    \
     
     \ /
      Last update: 2020-05-18 19:51    [W:4.147 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site