diff options
| author | Marcelo Tosatti <mtosatti@redhat.com> | 2010-01-12 19:42:09 +0100 |
|---|---|---|
| committer | Marcelo Tosatti <mtosatti@redhat.com> | 2010-01-25 15:26:38 +0100 |
| commit | d72118cecabbb76b96b77107a50c74d1bb36c0c1 (patch) | |
| tree | bb000f670a2d60ddca4439723debd2321b1738ca /virt/kvm | |
| parent | KVM: only allow one gsi per fd (diff) | |
| download | linux-d72118cecabbb76b96b77107a50c74d1bb36c0c1.tar.xz linux-d72118cecabbb76b96b77107a50c74d1bb36c0c1.zip | |
KVM: properly check max PIC pin in irq route setup
Otherwise memory beyond irq_states[16] might be accessed.
Noticed by Juan Quintela.
Cc: stable@kernel.org
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Acked-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Diffstat (limited to 'virt/kvm')
| -rw-r--r-- | virt/kvm/irq_comm.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c index 9b077342ab54..9fd5b3ebc517 100644 --- a/virt/kvm/irq_comm.c +++ b/virt/kvm/irq_comm.c @@ -302,6 +302,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt, { int r = -EINVAL; int delta; + unsigned max_pin; struct kvm_kernel_irq_routing_entry *ei; struct hlist_node *n; @@ -322,12 +323,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt, switch (ue->u.irqchip.irqchip) { case KVM_IRQCHIP_PIC_MASTER: e->set = kvm_set_pic_irq; + max_pin = 16; break; case KVM_IRQCHIP_PIC_SLAVE: e->set = kvm_set_pic_irq; + max_pin = 16; delta = 8; break; case KVM_IRQCHIP_IOAPIC: + max_pin = KVM_IOAPIC_NUM_PINS; e->set = kvm_set_ioapic_irq; break; default: @@ -335,7 +339,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt, } e->irqchip.irqchip = ue->u.irqchip.irqchip; e->irqchip.pin = ue->u.irqchip.pin + delta; - if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS) + if (e->irqchip.pin >= max_pin) goto out; rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi; break; |