From mboxrd@z Thu Jan 1 00:00:00 1970 From: Radim =?utf-8?B?S3LEjW3DocWZ?= Subject: [PATCH 5/4] KVM: x86: check bounds of APIC maps Date: Thu, 27 Nov 2014 23:30:19 +0100 Message-ID: <20141127223019.GA26994@potion.brq.redhat.com> References: <1417114994-25235-1-git-send-email-rkrcmar@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: kvm@vger.kernel.org, Paolo Bonzini , Gleb Natapov , Nadav Amit To: linux-kernel@vger.kernel.org Return-path: Content-Disposition: inline In-Reply-To: <1417114994-25235-1-git-send-email-rkrcmar@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org They can't be violated now, but we think against the infinite thing. Signed-off-by: Radim Kr=C4=8Dm=C3=A1=C5=99 --- I realized it could make a separate patch as well, which might be more convenient. arch/x86/kvm/lapic.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 6c2b8a5..ae019f6 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -190,15 +190,16 @@ static void recalculate_apic_map(struct kvm *kvm) kvm_for_each_vcpu(i, vcpu, kvm) { struct kvm_lapic *apic =3D vcpu->arch.apic; u16 cid, lid; - u32 ldr; - - new->phys_map[kvm_apic_id(apic)] =3D apic; + u32 ldr, aid; =20 + aid =3D kvm_apic_id(apic); ldr =3D kvm_apic_get_reg(apic, APIC_LDR); cid =3D apic_cluster_id(new, ldr); lid =3D apic_logical_id(new, ldr); =20 - if (lid) + if (aid < ARRAY_SIZE(new->phys_map)) + new->phys_map[aid] =3D apic; + if (lid && cid < ARRAY_SIZE(new->logical_map)) new->logical_map[cid][ffs(lid) - 1] =3D apic; } out: --=20 2.1.0