Skip to content

Commit 773cca1

Browse files
sean-jcbonzini
authored andcommitted
KVM: selftests: Fix out-of-bounds reads in CPUID test's array lookups
When looking for a "mangled", i.e. dynamic, CPUID entry, terminate the walk based on the number of array _entries_, not the size in bytes of the array. Iterating based on the total size of the array can result in false passes, e.g. if the random data beyond the array happens to match a CPUID entry's function and index. Fixes: fb18d05 ("selftest: kvm: x86: test KVM_GET_CPUID2 and guest visible CPUIDs against KVM_GET_SUPPORTED_CPUID") Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-ID: <20241003234337.273364-2-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 9a40006 commit 773cca1

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tools/testing/selftests/kvm/x86_64/cpuid_test.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ static bool is_cpuid_mangled(const struct kvm_cpuid_entry2 *entrie)
6060
{
6161
int i;
6262

63-
for (i = 0; i < sizeof(mangled_cpuids); i++) {
63+
for (i = 0; i < ARRAY_SIZE(mangled_cpuids); i++) {
6464
if (mangled_cpuids[i].function == entrie->function &&
6565
mangled_cpuids[i].index == entrie->index)
6666
return true;

0 commit comments

Comments
 (0)