lkml.org 
[lkml]   [2010]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[11/11] KVM: S390: fix potential array overrun in intercept handling
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Christian Borntraeger <borntraeger@de.ibm.com>

    commit 062d5e9b0d714f449b261bb522eadaaf6f00f438 upstream.

    kvm_handle_sie_intercept uses a jump table to get the intercept handler
    for a SIE intercept. Static code analysis revealed a potential problem:
    the intercept_funcs jump table was defined to contain (0x48 >> 2) entries,
    but we only checked for code > 0x48 which would cause an off-by-one
    array overflow if code == 0x48.

    Use the compiler and ARRAY_SIZE to automatically set the limits.

    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    arch/s390/kvm/intercept.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/arch/s390/kvm/intercept.c
    +++ b/arch/s390/kvm/intercept.c
    @@ -199,7 +199,7 @@ static int handle_instruction_and_prog(s
    return rc2;
    }

    -static const intercept_handler_t intercept_funcs[0x48 >> 2] = {
    +static const intercept_handler_t intercept_funcs[] = {
    [0x00 >> 2] = handle_noop,
    [0x04 >> 2] = handle_instruction,
    [0x08 >> 2] = handle_prog,
    @@ -216,7 +216,7 @@ int kvm_handle_sie_intercept(struct kvm_
    intercept_handler_t func;
    u8 code = vcpu->arch.sie_block->icptcode;

    - if (code & 3 || code > 0x48)
    + if (code & 3 || (code >> 2) >= ARRAY_SIZE(intercept_funcs))
    return -ENOTSUPP;
    func = intercept_funcs[code >> 2];
    if (func)



    \
     
     \ /
      Last update: 2010-01-26 20:33    [W:0.019 / U:185.796 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site