Commit a9e38c3e authored Oct 23, 2009 by Jan Kiszka Committed by Marcelo Tosatti Nov 04, 2009

KVM: x86: Catch potential overrun in MCE setup



We only allocate memory for 32 MCE banks (KVM_MAX_MCE_BANKS) but we
allow user space to fill up to 255 on setup (mcg_cap & 0xff), corrupting
kernel memory. Catch these overflows.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

parent 51bb296b

arch/x86/kvm/x86.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1692,7 +1692,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
		unsigned bank_num = mcg_cap & 0xff, bank;

		r = -EINVAL;
		if (!bank_num)
		if (!bank_num \|\| bank_num >= KVM_MAX_MCE_BANKS)
		goto out;
		if (mcg_cap & ~(KVM_MCE_CAP_SUPPORTED \| 0xff \| 0xff0000))
		goto out;