https://github.com/torvalds/linux
Revision 3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb authored by Jan H. Schönherr on 07 September 2017, 18:02:30 UTC, committed by Paolo Bonzini on 15 September 2017, 14:56:43 UTC
The value of the guest_irq argument to vmx_update_pi_irte() is
ultimately coming from a KVM_IRQFD API call. Do not BUG() in
vmx_update_pi_irte() if the value is out-of bounds. (Especially,
since KVM as a whole seems to hang after that.)

Instead, print a message only once if we find that we don't have a
route for a certain IRQ (which can be out-of-bounds or within the
array).

This fixes CVE-2017-1000252.

Fixes: efc644048ecde54 ("KVM: x86: Update IRTE for posted-interrupts")
Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 36ae3c0
History
Tip revision: 3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb authored by Jan H. Schönherr on 07 September 2017, 18:02:30 UTC
KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
Tip revision: 3a8b067
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 8.1 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.2 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 416.6 KB
Makefile -rw-r--r-- 58.8 KB
README -rw-r--r-- 722 bytes

README

back to top