From: andre.przywara@linaro•org (Andre Przywara)
To: linux-arm-kernel@lists•infradead.org
Subject: [PATCH v2] ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl
Date: Tue, 14 May 2013 00:23:15 +0200 [thread overview]
Message-ID: <519167D3.4030600@linaro.org> (raw)
In-Reply-To: <20130513055253.GC64337@ubuntu>
On 05/13/2013 07:52 AM, Christoffer Dall wrote:
> On Thu, May 09, 2013 at 12:28:06AM +0200, Andre Przywara wrote:
>> Some ARM KVM VCPU ioctls require the vCPU to be properly initialized
>> with the KVM_ARM_VCPU_INIT ioctl before being used with further
>> requests. KVM_RUN checks whether this initialization has been
>> done, but other ioctls do not.
>> Namely KVM_GET_REG_LIST will dereference an array with index -1
>> without initialization and thus leads to a kernel oops.
>> Fix this by adding checks before executing the ioctl handlers.
>>
>> Changes from v1:
>> * moved check into a static function with a meaningful name
>>
>> Signed-off-by: Andre Przywara <andre.przywara@linaro•org>
>> ---
>> arch/arm/kvm/arm.c | 19 +++++++++++++++++--
>> 1 file changed, 17 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
>> index c1fe498..b73b587 100644
>> --- a/arch/arm/kvm/arm.c
>> +++ b/arch/arm/kvm/arm.c
>> @@ -676,6 +676,15 @@ static void vcpu_pause(struct kvm_vcpu *vcpu)
>> wait_event_interruptible(*wq, !vcpu->arch.pause);
>> }
>>
>> +/*
>> + * Some ioctls require initialization by KVM_ARM_VCPU_INIT first, check
>> + * this with this function
>> + */
>> +static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu)
>> +{
>> + return vcpu->arch.target >= 0;
>> +}
>> +
>
> this should probably be a static inline in a header file instead, it's
> likely that it could be called from another file.
kvm_host.h looks like a natural candidate, but unfortunately struct
kvm_vcpu is opaque here, so dereferencing it does not work without
further changes which I do not deem to be justified. I used kvm_coproc.h
instead, which is loosely related (KVM_[SG]ET_ONE_REG) and just simply
works. If you don't think that's appropriate, just drop me a note. Patch
follows in a separate mail.
Regards,
Andre.
next prev parent reply other threads:[~2013-05-13 22:23 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-08 22:28 [PATCH v2] ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl Andre Przywara
2013-05-13 5:52 ` Christoffer Dall
2013-05-13 22:23 ` Andre Przywara [this message]
2013-05-13 22:42 ` Christoffer Dall
2013-05-14 7:07 ` Andre Przywara
2013-05-14 16:53 ` Rob Herring
2013-05-14 17:01 ` Christoffer Dall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=519167D3.4030600@linaro.org \
--to=andre.przywara@linaro$(echo .)org \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox