linux/arch/x86/kvm
Reiji Watanabe 04c4f2ee3f KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
__vmx_handle_exit() uses vcpu->run->internal.ndata as an index for
an array access.  Since vcpu->run is (can be) mapped to a user address
space with a writer permission, the 'ndata' could be updated by the
user process at anytime (the user process can set it to outside the
bounds of the array).
So, it is not safe that __vmx_handle_exit() uses the 'ndata' that way.

Fixes: 1aa561b1a4 ("kvm: x86: Add "last CPU" to some KVM_EXIT information")
Signed-off-by: Reiji Watanabe <reijiw@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Message-Id: <20210413154739.490299-1-reijiw@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
History 2021-04-13 18:23:41 -04:00
..
mmu KVM: x86/mmu: preserve pending TLB flush across calls to kvm_tdp_mmu_zap_sp 2021-04-08 07:48:18 -04:00
svm Merge branch 'kvm-fix-svm-races' into kvm-master 2021-04-01 05:14:05 -04:00
vmx KVM: VMX: Don't use vcpu->run->internal.ndata as an array index 2021-04-13 18:23:41 -04:00
cpuid.c KVM: x86: Advertise INVPCID by default 2021-02-18 07:33:29 -05:00
cpuid.h KVM: x86: Add helper to consolidate "raw" reserved GPA mask calculations 2021-02-04 09:27:30 -05:00
debugfs.c KVM: let kvm_destroy_vm_debugfs clean up vCPU debugfs directories 2020-06-04 11:00:54 -04:00
emulate.c KVM: x86: Restore all 64 bits of DR6 and DR7 during RSM on x86-64 2021-02-09 08:17:05 -05:00
hyperv.c KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment 2021-03-18 08:02:46 -04:00
hyperv.h KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs 2021-03-17 04:03:22 -04:00
i8254.c kvm: i8254: remove redundant assignment to pointer s 2020-06-11 12:35:18 -04:00
i8254.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
i8259.c KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks 2020-01-27 19:59:37 +01:00
ioapic.c KVM: ioapic: break infinite recursion on lazy EOI 2020-10-24 04:42:06 -04:00
ioapic.h kvm/x86: Remove redundant function implementations 2020-05-27 13:11:10 -04:00
irq.c KVM: x86/xen: Add event channel interrupt vector upcall 2021-02-04 14:19:39 +00:00
irq.h kvm/x86: Remove redundant function implementations 2020-05-27 13:11:10 -04:00
irq_comm.c x86/kvm: Use msi_msg shadow structs 2020-10-28 20:26:26 +01:00
Kconfig KVM: x86: allow compiling out the Xen hypercall interface 2021-03-02 14:30:45 -05:00
kvm_cache_regs.h KVM: x86: use static calls to reduce kvm_x86_ops overhead 2021-02-04 05:27:30 -05:00
kvm_emulate.h KVM: x86: reading DR cannot fail 2021-02-09 08:17:07 -05:00
lapic.c KVM: LAPIC: Advancing the timer expiration on guest initiated write 2021-03-12 13:18:52 -05:00
lapic.h KVM: x86: hyper-v: Always use to_hv_vcpu() accessor to get to 'struct kvm_vcpu_hv' 2021-02-09 08:17:13 -05:00
Makefile KVM: make: Fix out-of-source module builds 2021-03-30 13:07:10 -04:00
mmu.h KVM: x86: use static calls to reduce kvm_x86_ops overhead 2021-02-04 05:27:30 -05:00
mtrr.c KVM: x86: Add helper to consolidate "raw" reserved GPA mask calculations 2021-02-04 09:27:30 -05:00
pmu.c KVM: x86: use static calls to reduce kvm_x86_ops overhead 2021-02-04 05:27:30 -05:00
pmu.h KVM: vmx/pmu: Release guest LBR event via lazy release mechanism 2021-02-04 05:27:26 -05:00
trace.h KVM: x86/xen: intercept xen hypercalls if enabled 2021-02-04 14:18:45 +00:00
tss.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
x86.c KVM: x86: Prevent 'hv_clock->system_time' from going negative in kvm_guest_time_update() 2021-04-01 05:14:19 -04:00
x86.h KVM: x86: remove unused declaration of kvm_write_tsc() 2021-03-30 13:07:09 -04:00
xen.c KVM: x86/xen: Add support for vCPU runstate information 2021-03-02 14:30:54 -05:00
xen.h KVM: x86/xen: Add support for vCPU runstate information 2021-03-02 14:30:54 -05:00