* [PATCH] KVM: x86: Fix KVM_GET_MSR_INDEX_LIST
@ 2009-07-02 19:45 Jan Kiszka
2009-07-06 7:49 ` Avi Kivity
0 siblings, 1 reply; 2+ messages in thread
From: Jan Kiszka @ 2009-07-02 19:45 UTC (permalink / raw)
To: Avi Kivity; +Cc: kvm-devel
[-- Attachment #1: Type: text/plain, Size: 1224 bytes --]
So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a
wrong address in user space due to broken pointer arithmetic. This
caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had
probably no practical relevance). Moreover, the size check for the
user-provided kvm_msr_list forgot about emulated MSRs.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
arch/x86/kvm/x86.c | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 26dde25..1ed62a1 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1252,14 +1252,13 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list))
goto out;
r = -E2BIG;
- if (n < num_msrs_to_save)
+ if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
- if (copy_to_user(user_msr_list->indices
- + num_msrs_to_save * sizeof(u32),
+ if (copy_to_user(user_msr_list->indices + num_msrs_to_save,
&emulated_msrs,
ARRAY_SIZE(emulated_msrs) * sizeof(u32)))
goto out;
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 257 bytes --]
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] KVM: x86: Fix KVM_GET_MSR_INDEX_LIST
2009-07-02 19:45 [PATCH] KVM: x86: Fix KVM_GET_MSR_INDEX_LIST Jan Kiszka
@ 2009-07-06 7:49 ` Avi Kivity
0 siblings, 0 replies; 2+ messages in thread
From: Avi Kivity @ 2009-07-06 7:49 UTC (permalink / raw)
To: Jan Kiszka; +Cc: kvm-devel
On 07/02/2009 10:45 PM, Jan Kiszka wrote:
> So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a
> wrong address in user space due to broken pointer arithmetic. This
> caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had
> probably no practical relevance). Moreover, the size check for the
> user-provided kvm_msr_list forgot about emulated MSRs.
>
Applied, thanks. And ouch.
--
error compiling committee.c: too many arguments to function
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-07-06 7:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-07-02 19:45 [PATCH] KVM: x86: Fix KVM_GET_MSR_INDEX_LIST Jan Kiszka
2009-07-06 7:49 ` Avi Kivity
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).