Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83676e92 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Radim Krčmář
Browse files

KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID 



This causes an ugly dmesg splat.  Beautified syzkaller testcase:

    #include <unistd.h>
    #include <sys/syscall.h>
    #include <sys/ioctl.h>
    #include <fcntl.h>
    #include <linux/kvm.h>

    long r[8];

    int main()
    {
        struct kvm_cpuid2 c = { 0 };
        r[2] = open("/dev/kvm", O_RDWR);
        r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
        r[4] = ioctl(r[3], KVM_CREATE_VCPU, 0x8);
        r[7] = ioctl(r[4], KVM_SET_CPUID, &c);
        return 0;
    }

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
parent b21629da

arch/x86/kvm/cpuid.c

+12 −10
Original line number Diff line number Diff line
@@ -181,19 +181,22 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu, 
			     struct kvm_cpuid_entry __user *entries)

{

	int r, i;

	struct kvm_cpuid_entry *cpuid_entries;

	struct kvm_cpuid_entry *cpuid_entries = NULL;



	r = -E2BIG;

	if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)

		goto out;

	r = -ENOMEM;

	cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry) * cpuid->nent);

	if (cpuid->nent) {

		cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry) *

					cpuid->nent);

		if (!cpuid_entries)

			goto out;

		r = -EFAULT;

		if (copy_from_user(cpuid_entries, entries,

				   cpuid->nent * sizeof(struct kvm_cpuid_entry)))

		goto out_free;

			goto out;

	}

	for (i = 0; i < cpuid->nent; i++) {

		vcpu->arch.cpuid_entries[i].function = cpuid_entries[i].function;

		vcpu->arch.cpuid_entries[i].eax = cpuid_entries[i].eax;
@@ -212,9 +215,8 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu, 
	kvm_x86_ops->cpuid_update(vcpu);

	r = kvm_update_cpuid(vcpu);



out_free:

	vfree(cpuid_entries);

out:

	vfree(cpuid_entries);

	return r;

}