diff options
| author |   Linus Torvalds <torvalds@linux-foundation.org> | 2013-03-19 18:24:12 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-03-19 18:24:12 -0700 |
| commit | ea4a0ce11160200410abbabd44ec9e75e93a95be (patch) | |
| tree | 20ceced4ddc4b34d78ce1318d2bc5a58debf08aa /virt | |
| parent | Merge tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs (diff) | |
| parent | KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (diff) | |
Merge git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Marcelo Tosatti.
* git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)
KVM: x86: fix deadlock in clock-in-progress request handling
KVM: allow host header to be included even for !CONFIG_KVM
Diffstat (limited to 'virt')
| -rw-r--r-- | virt/kvm/ioapic.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c index ce82b9401958..5ba005c00e2f 100644 --- a/virt/kvm/ioapic.c +++ b/virt/kvm/ioapic.c @@ -74,9 +74,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, u32 redir_index = (ioapic->ioregsel - 0x10) >> 1; u64 redir_content; - ASSERT(redir_index < IOAPIC_NUM_PINS); + if (redir_index < IOAPIC_NUM_PINS) + redir_content = + ioapic->redirtbl[redir_index].bits; + else + redir_content = ~0ULL; - redir_content = ioapic->redirtbl[redir_index].bits; result = (ioapic->ioregsel & 0x1) ? (redir_content >> 32) & 0xffffffff : redir_content & 0xffffffff; |