lkml.org 
[lkml]   [2021]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid
On Tue, Jan 12, 2021, Paolo Bonzini wrote:
> On 12/01/21 00:01, Sean Christopherson wrote:
> > > Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of
> > > CPUID.80000008H:EAX?
>
> The low 6 bits I guess---yes, that would make sense and it would have also
> fixed the bug.

No, that wouldn't have fixed this specific bug. In this case, the issue was
CPUID.80000008H:AL == 0; masking off bits 7:6 wouldn't have changed anything.

And, masking bits 7:6 is architecturally wrong. Both the SDM and APM state that
bits 7:0 contain the number of PA bits.

KVM could reject guest.MAXPA > host.MAXPA, but arbitrarily dropping bits would
be wrong.

\
 
 \ /
  Last update: 2021-01-12 17:57    [W:0.044 / U:0.232 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site