Commit e125e7b6 authored Jul 02, 2009 by Jan Kiszka Committed by Avi Kivity Aug 05, 2009

KVM: Fix KVM_GET_MSR_INDEX_LIST



So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a
wrong address in user space due to broken pointer arithmetic. This
caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had
probably no practical relevance). Moreover, the size check for the
user-provided kvm_msr_list forgot about emulated MSRs.

Cc: stable@kernel.org
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

parent 90bc1a65

arch/x86/kvm/x86.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1079,14 +1079,13 @@ long kvm_arch_dev_ioctl(struct file *filp,
		if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list))
		goto out;
		r = -E2BIG;
		if (n < num_msrs_to_save)
		if (n < msr_list.nmsrs)
		goto out;
		r = -EFAULT;
		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
		num_msrs_to_save * sizeof(u32)))
		goto out;
		if (copy_to_user(user_msr_list->indices
		+ num_msrs_to_save * sizeof(u32),
		if (copy_to_user(user_msr_list->indices + num_msrs_to_save,
		&emulated_msrs,
		ARRAY_SIZE(emulated_msrs) * sizeof(u32)))
		goto out;