Skip to content

Commit 4ea9439

Browse files
dwmw2bonzini
authored andcommitted
KVM: x86/xen: Validate port number in SCHEDOP_poll
We shouldn't allow guests to poll on arbitrary port numbers off the end of the event channel table. Fixes: 1a65105 ("KVM: x86/xen: handle PV spinlocks slowpath") [dwmw2: my bug though; the original version did check the validity as a side-effect of an idr_find() which I ripped out in refactoring.] Reported-by: Michal Luczaj <mhal@rbox.co> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Sean Christopherson <seanjc@google.com> Cc: stable@kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent d72cf8f commit 4ea9439

File tree

1 file changed

+12
-8
lines changed

1 file changed

+12
-8
lines changed

arch/x86/kvm/xen.c

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -954,6 +954,14 @@ static int kvm_xen_hypercall_complete_userspace(struct kvm_vcpu *vcpu)
954954
return kvm_xen_hypercall_set_result(vcpu, run->xen.u.hcall.result);
955955
}
956956

957+
static inline int max_evtchn_port(struct kvm *kvm)
958+
{
959+
if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)
960+
return EVTCHN_2L_NR_CHANNELS;
961+
else
962+
return COMPAT_EVTCHN_2L_NR_CHANNELS;
963+
}
964+
957965
static bool wait_pending_event(struct kvm_vcpu *vcpu, int nr_ports,
958966
evtchn_port_t *ports)
959967
{
@@ -1042,6 +1050,10 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode,
10421050
*r = -EFAULT;
10431051
goto out;
10441052
}
1053+
if (ports[i] >= max_evtchn_port(vcpu->kvm)) {
1054+
*r = -EINVAL;
1055+
goto out;
1056+
}
10451057
}
10461058

10471059
if (sched_poll.nr_ports == 1)
@@ -1297,14 +1309,6 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu)
12971309
return 0;
12981310
}
12991311

1300-
static inline int max_evtchn_port(struct kvm *kvm)
1301-
{
1302-
if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)
1303-
return EVTCHN_2L_NR_CHANNELS;
1304-
else
1305-
return COMPAT_EVTCHN_2L_NR_CHANNELS;
1306-
}
1307-
13081312
static void kvm_xen_check_poller(struct kvm_vcpu *vcpu, int port)
13091313
{
13101314
int poll_evtchn = vcpu->arch.xen.poll_evtchn;

0 commit comments

Comments
 (0)