Revision 773e89ab0056aaa2baa1ffd9f044551654410104 authored by Zelin Deng on 29 September 2021, 05:13:49 UTC, committed by Paolo Bonzini on 30 September 2021, 08:08:15 UTC
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements;
if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is
64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with
"src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and
a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to
be valid.
Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable")
Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Message-Id: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent ad9af93
| File | Mode | Size |
|---|---|---|
| auth_gss | ||
| xprtrdma | ||
| Kconfig | -rw-r--r-- | 2.4 KB |
| Makefile | -rw-r--r-- | 636 bytes |
| addr.c | -rw-r--r-- | 8.7 KB |
| auth.c | -rw-r--r-- | 20.7 KB |
| auth_null.c | -rw-r--r-- | 2.7 KB |
| auth_unix.c | -rw-r--r-- | 5.3 KB |
| backchannel_rqst.c | -rw-r--r-- | 11.0 KB |
| cache.c | -rw-r--r-- | 45.6 KB |
| clnt.c | -rw-r--r-- | 72.4 KB |
| debugfs.c | -rw-r--r-- | 6.3 KB |
| fail.h | -rw-r--r-- | 469 bytes |
| netns.h | -rw-r--r-- | 976 bytes |
| rpc_pipe.c | -rw-r--r-- | 35.8 KB |
| rpcb_clnt.c | -rw-r--r-- | 27.5 KB |
| sched.c | -rw-r--r-- | 32.9 KB |
| socklib.c | -rw-r--r-- | 7.9 KB |
| socklib.h | -rw-r--r-- | 470 bytes |
| stats.c | -rw-r--r-- | 8.6 KB |
| sunrpc.h | -rw-r--r-- | 1.7 KB |
| sunrpc_syms.c | -rw-r--r-- | 3.0 KB |
| svc.c | -rw-r--r-- | 41.7 KB |
| svc_xprt.c | -rw-r--r-- | 38.5 KB |
| svcauth.c | -rw-r--r-- | 5.3 KB |
| svcauth_unix.c | -rw-r--r-- | 21.4 KB |
| svcsock.c | -rw-r--r-- | 39.1 KB |
| sysctl.c | -rw-r--r-- | 3.5 KB |
| sysfs.c | -rw-r--r-- | 16.1 KB |
| sysfs.h | -rw-r--r-- | 1.1 KB |
| timer.c | -rw-r--r-- | 2.9 KB |
| xdr.c | -rw-r--r-- | 54.9 KB |
| xprt.c | -rw-r--r-- | 53.6 KB |
| xprtmultipath.c | -rw-r--r-- | 14.2 KB |
| xprtsock.c | -rw-r--r-- | 82.3 KB |
Computing file changes ...
