| Message ID | 20241104191503.74725-1-bjorn@kernel.org (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | riscv: kvm: Fix out-of-bounds array access | expand |
On Tue, Nov 5, 2024 at 12:45 AM Björn Töpel <bjorn@kernel.org> wrote: > > From: Björn Töpel <bjorn@rivosinc.com> > > In kvm_riscv_vcpu_sbi_init() the entry->ext_idx can contain an > out-of-bound index. This is used as a special marker for the base > extensions, that cannot be disabled. However, when traversing the > extensions, that special marker is not checked prior indexing the > array. > > Add an out-of-bounds check to the function. > > Fixes: 56d8a385b605 ("RISC-V: KVM: Allow some SBI extensions to be disabled by default") > Signed-off-by: Björn Töpel <bjorn@rivosinc.com> > --- > Don't know if it matters, but I hit this when trying kvmtool. Looks like this went unnoticed. Thanks for catching. Reviewed-by: Anup Patel <anup@brainfault.org> Queued this patch for Linux-6.13. Thanks, Anup > > > Björn > --- > arch/riscv/kvm/vcpu_sbi.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c > index 7de128be8db9..6e704ed86a83 100644 > --- a/arch/riscv/kvm/vcpu_sbi.c > +++ b/arch/riscv/kvm/vcpu_sbi.c > @@ -486,19 +486,22 @@ void kvm_riscv_vcpu_sbi_init(struct kvm_vcpu *vcpu) > struct kvm_vcpu_sbi_context *scontext = &vcpu->arch.sbi_context; > const struct kvm_riscv_sbi_extension_entry *entry; > const struct kvm_vcpu_sbi_extension *ext; > - int i; > + int idx, i; > > for (i = 0; i < ARRAY_SIZE(sbi_ext); i++) { > entry = &sbi_ext[i]; > ext = entry->ext_ptr; > + idx = entry->ext_idx; > + > + if (idx < 0 || idx >= ARRAY_SIZE(scontext->ext_status)) > + continue; > > if (ext->probe && !ext->probe(vcpu)) { > - scontext->ext_status[entry->ext_idx] = > - KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE; > + scontext->ext_status[idx] = KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE; > continue; > } > > - scontext->ext_status[entry->ext_idx] = ext->default_disabled ? > + scontext->ext_status[idx] = ext->default_disabled ? > KVM_RISCV_SBI_EXT_STATUS_DISABLED : > KVM_RISCV_SBI_EXT_STATUS_ENABLED; > } > > base-commit: 59b723cd2adbac2a34fc8e12c74ae26ae45bf230 > -- > 2.43.0 >
diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c index 7de128be8db9..6e704ed86a83 100644 --- a/arch/riscv/kvm/vcpu_sbi.c +++ b/arch/riscv/kvm/vcpu_sbi.c @@ -486,19 +486,22 @@ void kvm_riscv_vcpu_sbi_init(struct kvm_vcpu *vcpu) struct kvm_vcpu_sbi_context *scontext = &vcpu->arch.sbi_context; const struct kvm_riscv_sbi_extension_entry *entry; const struct kvm_vcpu_sbi_extension *ext; - int i; + int idx, i; for (i = 0; i < ARRAY_SIZE(sbi_ext); i++) { entry = &sbi_ext[i]; ext = entry->ext_ptr; + idx = entry->ext_idx; + + if (idx < 0 || idx >= ARRAY_SIZE(scontext->ext_status)) + continue; if (ext->probe && !ext->probe(vcpu)) { - scontext->ext_status[entry->ext_idx] = - KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE; + scontext->ext_status[idx] = KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE; continue; } - scontext->ext_status[entry->ext_idx] = ext->default_disabled ? + scontext->ext_status[idx] = ext->default_disabled ? KVM_RISCV_SBI_EXT_STATUS_DISABLED : KVM_RISCV_SBI_EXT_STATUS_ENABLED; }