Re: [PATCH] kvm-s390: fix potential array overrun in intercept handling

[Avi Kivity <avi@redhat.com>]

On 01/21/2010 12:56 PM, Christian Borntraeger wrote:
> Avi, Marcelo,
>
> kvm_handle_sie_intercept uses a jump table to get the intercept handler
> for a SIE intercept. Static code analysis revealed a potential problem:
> the intercept_funcs jump table was defined to contain (0x48>>  2) entries,
> but we only checked for code>  0x48 which would cause an off-by-one
> array overflow if code == 0x48.
>
> Since the table is only populated up to (0x28>>  2), we can reduce the
> jump table size while fixing the off-by-one.
>
>    

>
> -static const intercept_handler_t intercept_funcs[0x48>>  2] = {
> +static const intercept_handler_t intercept_funcs[(0x28>>  2) + 1] = {
>   	[0x00>>  2] = handle_noop,
>   	[0x04>>  2] = handle_instruction,
>   	[0x08>>  2] = handle_prog,
>   	[0x0C>>  2] = handle_instruction_and_prog,
>   	[0x10>>  2] = handle_noop,
>   	[0x14>>  2] = handle_noop,
>   	[0x1C>>  2] = kvm_s390_handle_wait,
>   	[0x20>>  2] = handle_validity,
>   	[0x28>>  2] = handle_stop,
>   };
>    

You can define the array without a size to let the compiler figure out 
the minimum size.

>
>   int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu)
>   {
>   	intercept_handler_t func;
>   	u8 code = vcpu->arch.sie_block->icptcode;
>
> -	if (code&  3 || code>  0x48)
> +	if (code&  3 || code>  0x28)
>   		return -ENOTSUPP;
>    

And here, check against ARRAY_SIZE() instead of a magic number.


-- 
error compiling committee.c: too many arguments to function