From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [PATCH v2] kvm: nVMX: off by one in vmx_write_pml_buffer() Date: Wed, 10 May 2017 23:43:03 +0300 Message-ID: <20170510204302.ilb7bs3pbr6h7d7u@mwanda> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Radim =?utf-8?B?S3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, kvm@vger.kernel.org, kernel-janitors@vger.kernel.org To: Paolo Bonzini , Bandan Das Return-path: Received: from aserp1040.oracle.com ([141.146.126.69]:18105 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751182AbdEJUn1 (ORCPT ); Wed, 10 May 2017 16:43:27 -0400 Content-Disposition: inline In-Reply-To: Sender: kvm-owner@vger.kernel.org List-ID: There are PML_ENTITY_NUM elements in the pml_address[] array so the > should be >= or we write beyond the end of the array when we do: pml_address[vmcs12->guest_pml_index--] = gpa; This causes a static checker warning but the runtime impact is minimal. The ->guest_pml_index variable can only be set to PML_ENTITY_NUM by a buggy hypervisor. Fixes: c5f983f6e845 ("nVMX: Implement emulated Page Modification Logging") Signed-off-by: Dan Carpenter --- v2: update the changelog to say that this is a low severity bug. diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index c6f4ad44aa95..7698e8f321bf 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -11213,7 +11213,7 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu) if (!nested_cpu_has_pml(vmcs12)) return 0; - if (vmcs12->guest_pml_index > PML_ENTITY_NUM) { + if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) { vmx->nested.pml_full = true; return 1; }