swh:1:snp:c3bf2749e3476071fa748f67b0ffa2fdc5fe49d9
Revision 773e89ab0056aaa2baa1ffd9f044551654410104 authored by Zelin Deng on 29 September 2021, 05:13:49 UTC, committed by Paolo Bonzini on 30 September 2021, 08:08:15 UTC
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements;
if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is
64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with
"src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and
a wild pointer.  Change it to "this_cpu_pvti()" which is guaranteed to
be valid.

Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable")
Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Message-Id: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent ad9af93
History
Tip revision: d1221cea11fca0f6946bdd032a45b22cecfc0f99 authored by Linus Torvalds on 13 September 2022, 13:11:38 UTC
Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Tip revision: d1221ce
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 16.6 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 71 bytes
.gitattributes -rw-r--r-- 62 bytes
.gitignore -rw-r--r-- 1.9 KB
.mailmap -rw-r--r-- 19.8 KB
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 98.6 KB
Kbuild -rw-r--r-- 1.3 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 605.7 KB
Makefile -rw-r--r-- 64.0 KB
README -rw-r--r-- 727 bytes

README

back to top