| Message ID | 20221222203021.1944101-3-mhal@rbox.co (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RFC,1/2] KVM: x86/xen: Fix use-after-free in kvm_xen_eventfd_update() | expand |
On 12/22/22 21:30, Michal Luczaj wrote: > Port number is validated in kvm_xen_setattr_evtchn(). > Remove superfluous checks in kvm_xen_eventfd_assign() and > kvm_xen_eventfd_update(). > > Signed-off-by: Michal Luczaj <mhal@rbox.co> > --- > arch/x86/kvm/xen.c | 8 +------- > 1 file changed, 1 insertion(+), 7 deletions(-) > > diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c > index 8e17629e5665..87da95ceba92 100644 > --- a/arch/x86/kvm/xen.c > +++ b/arch/x86/kvm/xen.c > @@ -1828,9 +1828,6 @@ static int kvm_xen_eventfd_update(struct kvm *kvm, > int ret = -EINVAL; > int idx; > > - if (!port || port >= max_evtchn_port(kvm)) > - return -EINVAL; > - > idx = srcu_read_lock(&kvm->srcu); > > mutex_lock(&kvm->lock); > @@ -1880,12 +1877,9 @@ static int kvm_xen_eventfd_assign(struct kvm *kvm, > { > u32 port = data->u.evtchn.send_port; > struct eventfd_ctx *eventfd = NULL; > - struct evtchnfd *evtchnfd = NULL; > + struct evtchnfd *evtchnfd; > int ret = -EINVAL; > > - if (!port || port >= max_evtchn_port(kvm)) > - return -EINVAL; > - > evtchnfd = kzalloc(sizeof(struct evtchnfd), GFP_KERNEL); > if (!evtchnfd) > return -ENOMEM; Queued this one, thanks. Paolo
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 8e17629e5665..87da95ceba92 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1828,9 +1828,6 @@ static int kvm_xen_eventfd_update(struct kvm *kvm, int ret = -EINVAL; int idx; - if (!port || port >= max_evtchn_port(kvm)) - return -EINVAL; - idx = srcu_read_lock(&kvm->srcu); mutex_lock(&kvm->lock); @@ -1880,12 +1877,9 @@ static int kvm_xen_eventfd_assign(struct kvm *kvm, { u32 port = data->u.evtchn.send_port; struct eventfd_ctx *eventfd = NULL; - struct evtchnfd *evtchnfd = NULL; + struct evtchnfd *evtchnfd; int ret = -EINVAL; - if (!port || port >= max_evtchn_port(kvm)) - return -EINVAL; - evtchnfd = kzalloc(sizeof(struct evtchnfd), GFP_KERNEL); if (!evtchnfd) return -ENOMEM;
Port number is validated in kvm_xen_setattr_evtchn(). Remove superfluous checks in kvm_xen_eventfd_assign() and kvm_xen_eventfd_update(). Signed-off-by: Michal Luczaj <mhal@rbox.co> --- arch/x86/kvm/xen.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)