Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85c856b3 authored by Jim Mattson's avatar Jim Mattson Committed by Paolo Bonzini
Browse files

kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types 



Bitwise shifts by amounts greater than or equal to the width of the left
operand are undefined. A malicious guest can exploit this to crash a
32-bit host, due to the BUG_ON(1)'s in handle_{invept,invvpid}.

Signed-off-by: default avatarJim Mattson <jmattson@google.com>
Message-Id: <1477496318-17681-1-git-send-email-jmattson@google.com>
[Change 1UL to 1, to match the range check on the shift count. - Paolo]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 58e3948a

arch/x86/kvm/vmx.c

+2 −2
Original line number Diff line number Diff line
@@ -7659,7 +7659,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) 


	types = (vmx->nested.nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;



	if (!(types & (1UL << type))) {

	if (type >= 32 || !(types & (1 << type))) {

		nested_vmx_failValid(vcpu,

				VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);

		skip_emulated_instruction(vcpu);
@@ -7722,7 +7722,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) 


	types = (vmx->nested.nested_vmx_vpid_caps >> 8) & 0x7;



	if (!(types & (1UL << type))) {

	if (type >= 32 || !(types & (1 << type))) {

		nested_vmx_failValid(vcpu,

			VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);

		skip_emulated_instruction(vcpu);