| Message ID | 4A4D0E6B.6090105@web.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 07/02/2009 10:45 PM, Jan Kiszka wrote: > So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a > wrong address in user space due to broken pointer arithmetic. This > caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had > probably no practical relevance). Moreover, the size check for the > user-provided kvm_msr_list forgot about emulated MSRs. > Applied, thanks. And ouch.
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 26dde25..1ed62a1 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1252,14 +1252,13 @@ long kvm_arch_dev_ioctl(struct file *filp, if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list)) goto out; r = -E2BIG; - if (n < num_msrs_to_save) + if (n < msr_list.nmsrs) goto out; r = -EFAULT; if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; - if (copy_to_user(user_msr_list->indices - + num_msrs_to_save * sizeof(u32), + if (copy_to_user(user_msr_list->indices + num_msrs_to_save, &emulated_msrs, ARRAY_SIZE(emulated_msrs) * sizeof(u32))) goto out;
So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a wrong address in user space due to broken pointer arithmetic. This caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had probably no practical relevance). Moreover, the size check for the user-provided kvm_msr_list forgot about emulated MSRs. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> --- arch/x86/kvm/x86.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-)