OSDN Git Service

KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
authorJan H. Schönherr <jschoenh@amazon.de>
Thu, 7 Sep 2017 18:02:30 +0000 (19:02 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Oct 2017 07:44:03 +0000 (09:44 +0200)
commit3d4213fac7d10e72859112c9100d8015ce442a3a
tree8b13695e879685f8c0f3e1caa9e71304b3e9a1da
parente3a643b3288af043f253cfd7e5bf5a4889964d7c
KVM: VMX: Do not BUG() on out-of-bounds guest IRQ

commit 3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb upstream.

The value of the guest_irq argument to vmx_update_pi_irte() is
ultimately coming from a KVM_IRQFD API call. Do not BUG() in
vmx_update_pi_irte() if the value is out-of bounds. (Especially,
since KVM as a whole seems to hang after that.)

Instead, print a message only once if we find that we don't have a
route for a certain IRQ (which can be out-of-bounds or within the
array).

This fixes CVE-2017-1000252.

Fixes: efc644048ecde54 ("KVM: x86: Update IRTE for posted-interrupts")
Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/kvm/vmx.c