Revision 773e89ab0056aaa2baa1ffd9f044551654410104 authored by Zelin Deng on 29 September 2021, 05:13:49 UTC, committed by Paolo Bonzini on 30 September 2021, 08:08:15 UTC
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements;
if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is
64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with
"src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and
a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to
be valid.
Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable")
Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Message-Id: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent ad9af93
| File | Mode | Size |
|---|---|---|
| acrn | ||
| auxdisplay | ||
| binderfs | ||
| bpf | ||
| configfs | ||
| connector | ||
| ftrace | ||
| hidraw | ||
| hw_breakpoint | ||
| kdb | ||
| kfifo | ||
| kmemleak | ||
| kobject | ||
| kprobes | ||
| landlock | ||
| livepatch | ||
| mei | ||
| nitro_enclaves | ||
| pidfd | ||
| pktgen | ||
| qmi | ||
| rpmsg | ||
| seccomp | ||
| timers | ||
| trace_events | ||
| trace_printk | ||
| uhid | ||
| v4l | ||
| vfio-mdev | ||
| vfs | ||
| watch_queue | ||
| watchdog | ||
| Kconfig | -rw-r--r-- | 6.9 KB |
| Makefile | -rw-r--r-- | 1.3 KB |
Computing file changes ...
