From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: [PATCH 2/3] KVM: fix segment_base() error checking. Date: Thu, 25 Feb 2010 12:43:08 +0200 Message-ID: <1267094589-4209-2-git-send-email-gleb@redhat.com> References: <1267094589-4209-1-git-send-email-gleb@redhat.com> Cc: kvm@vger.kernel.org To: avi@redhat.com, mtosatti@redhat.com Return-path: Received: from mx1.redhat.com ([209.132.183.28]:16212 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759184Ab0BYKnL (ORCPT ); Thu, 25 Feb 2010 05:43:11 -0500 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o1PAhASB014072 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 25 Feb 2010 05:43:11 -0500 In-Reply-To: <1267094589-4209-1-git-send-email-gleb@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: fix segment_base() to properly check for null segment selector and avoid accessing NULL pointer if ldt selector in null. Signed-off-by: Gleb Natapov --- arch/x86/kvm/x86.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 558eb9a..49f5c7b 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -229,7 +229,7 @@ unsigned long segment_base(u16 selector) unsigned long table_base; unsigned long v; - if (selector == 0) + if (!(selector & ~3)) return 0; native_store_gdt(&gdt); @@ -238,6 +238,8 @@ unsigned long segment_base(u16 selector) if (selector & 4) { /* from ldt */ u16 ldt_selector = kvm_read_ldt(); + if (!(ldt_selector & ~3)) + return 0; table_base = segment_base(ldt_selector); } d = (struct desc_struct *)(table_base + (selector & ~7)); -- 1.6.5