lkml.org 
[lkml]   [2009]   [Oct]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 16/26] KVM: Prevent overflow in KVM_GET_SUPPORTED_CPUID
    2.6.31-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Avi Kivity <avi@redhat.com>

    commit 6a54435560efdab1a08f429a954df4d6c740bddf upstream.

    The number of entries is multiplied by the entry size, which can
    overflow on 32-bit hosts. Bound the entry count instead.

    Reported-by: David Wagner <daw@cs.berkeley.edu>
    Signed-off-by: Avi Kivity <avi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    arch/x86/kvm/x86.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -1429,6 +1429,8 @@ static int kvm_dev_ioctl_get_supported_c

    if (cpuid->nent < 1)
    goto out;
    + if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
    + cpuid->nent = KVM_MAX_CPUID_ENTRIES;
    r = -ENOMEM;
    cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry2) * cpuid->nent);
    if (!cpuid_entries)



    \
     
     \ /
      Last update: 2009-10-10 01:45    [W:0.024 / U:59.592 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site