From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kiszka Subject: [PATCH] KVM: x86: Fix KVM_GET_MSR_INDEX_LIST Date: Thu, 02 Jul 2009 21:45:47 +0200 Message-ID: <4A4D0E6B.6090105@web.de> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig19F75269A20CFD97EB557282" Cc: kvm-devel To: Avi Kivity Return-path: Received: from fmmailgate03.web.de ([217.72.192.234]:50552 "EHLO fmmailgate03.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752863AbZGBTpw (ORCPT ); Thu, 2 Jul 2009 15:45:52 -0400 Sender: kvm-owner@vger.kernel.org List-ID: This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig19F75269A20CFD97EB557282 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a wrong address in user space due to broken pointer arithmetic. This caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had probably no practical relevance). Moreover, the size check for the user-provided kvm_msr_list forgot about emulated MSRs. Signed-off-by: Jan Kiszka --- arch/x86/kvm/x86.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 26dde25..1ed62a1 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1252,14 +1252,13 @@ long kvm_arch_dev_ioctl(struct file *filp, if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list)) goto out; r =3D -E2BIG; - if (n < num_msrs_to_save) + if (n < msr_list.nmsrs) goto out; r =3D -EFAULT; if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; - if (copy_to_user(user_msr_list->indices - + num_msrs_to_save * sizeof(u32), + if (copy_to_user(user_msr_list->indices + num_msrs_to_save, &emulated_msrs, ARRAY_SIZE(emulated_msrs) * sizeof(u32))) goto out; --------------enig19F75269A20CFD97EB557282 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAkpNDm8ACgkQniDOoMHTA+mBeQCeLua03UvEobUEhnqwpDoD85mG 2GsAnAwMHN5SqWITv0IiQTIOsoWaEg1n =6Id2 -----END PGP SIGNATURE----- --------------enig19F75269A20CFD97EB557282--