[1/2] kvm: x86: Bounds-check argument to x86_exception_has_error_code
diff mbox series

Message ID 20181012180429.259916-1-jmattson@google.com
State New
Headers show
Series
  • [1/2] kvm: x86: Bounds-check argument to x86_exception_has_error_code
Related show

Commit Message

Jim Mattson Oct. 12, 2018, 6:04 p.m. UTC
x86_exception_has_error_code should deterministically return false if
its operand is greater than or equal to 32.

Fixes: 0447378a4a793 ("kvm: vmx: Nested VM-entry prereqs for event inj.")
Cc: Marc Orr <marcorr@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 arch/x86/kvm/x86.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sean Christopherson Oct. 12, 2018, 8:07 p.m. UTC | #1
On Fri, Oct 12, 2018 at 11:04:28AM -0700, Jim Mattson wrote:
> x86_exception_has_error_code should deterministically return false if
> its operand is greater than or equal to 32.
> 
> Fixes: 0447378a4a793 ("kvm: vmx: Nested VM-entry prereqs for event inj.")
> Cc: Marc Orr <marcorr@google.com>
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/x86.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> index 67b9568613f3..b7890b248e64 100644
> --- a/arch/x86/kvm/x86.h
> +++ b/arch/x86/kvm/x86.h
> @@ -116,7 +116,7 @@ static inline bool x86_exception_has_error_code(unsigned int vector)
>  			BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
>  			BIT(PF_VECTOR) | BIT(AC_VECTOR);
>  
> -	return (1U << vector) & exception_has_error_code;
> +	return vector < 32 && (1U << vector) & exception_has_error_code;

This feels like it should be a WARN_ON, i.e. KVM should be ensuring
the vector itself is valid prior to querying whether or not it should
have an error code.

>  }
>  
>  static inline bool mmu_is_nested(struct kvm_vcpu *vcpu)
> -- 
> 2.19.1.331.ge82ca0e54c-goog
>
Jim Mattson Oct. 12, 2018, 9:24 p.m. UTC | #2
On Fri, Oct 12, 2018 at 1:07 PM, Sean Christopherson
<sean.j.christopherson@intel.com> wrote:

> This feels like it should be a WARN_ON, i.e. KVM should be ensuring
> the vector itself is valid prior to querying whether or not it should
> have an error code.

I'll add a WARN_ON in v2.
Krish Sadhukhan Oct. 12, 2018, 10:59 p.m. UTC | #3
On 10/12/2018 11:04 AM, Jim Mattson wrote:
> x86_exception_has_error_code should deterministically return false if
> its operand is greater than or equal to 32.
>
> Fixes: 0447378a4a793 ("kvm: vmx: Nested VM-entry prereqs for event inj.")
> Cc: Marc Orr <marcorr@google.com>
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>   arch/x86/kvm/x86.h | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> index 67b9568613f3..b7890b248e64 100644
> --- a/arch/x86/kvm/x86.h
> +++ b/arch/x86/kvm/x86.h
> @@ -116,7 +116,7 @@ static inline bool x86_exception_has_error_code(unsigned int vector)
>   			BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
>   			BIT(PF_VECTOR) | BIT(AC_VECTOR);
>   
> -	return (1U << vector) & exception_has_error_code;
> +	return vector < 32 && (1U << vector) & exception_has_error_code;
>   }
>   
>   static inline bool mmu_is_nested(struct kvm_vcpu *vcpu)

Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Marc Orr Oct. 15, 2018, 1:41 p.m. UTC | #4
On Fri, Oct 12, 2018 at 3:59 PM Krish Sadhukhan
<krish.sadhukhan@oracle.com> wrote:
>
>
>
> On 10/12/2018 11:04 AM, Jim Mattson wrote:
> > x86_exception_has_error_code should deterministically return false if
> > its operand is greater than or equal to 32.
> >
> > Fixes: 0447378a4a793 ("kvm: vmx: Nested VM-entry prereqs for event inj.")
> > Cc: Marc Orr <marcorr@google.com>
> > Signed-off-by: Jim Mattson <jmattson@google.com>
> > ---
> >   arch/x86/kvm/x86.h | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> > index 67b9568613f3..b7890b248e64 100644
> > --- a/arch/x86/kvm/x86.h
> > +++ b/arch/x86/kvm/x86.h
> > @@ -116,7 +116,7 @@ static inline bool x86_exception_has_error_code(unsigned int vector)
> >                       BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
> >                       BIT(PF_VECTOR) | BIT(AC_VECTOR);
> >
> > -     return (1U << vector) & exception_has_error_code;
> > +     return vector < 32 && (1U << vector) & exception_has_error_code;
> >   }
> >
> >   static inline bool mmu_is_nested(struct kvm_vcpu *vcpu)
>
> Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>

Reviewed-by: Marc Orr <marcorr@google.com>

Patch
diff mbox series

diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 67b9568613f3..b7890b248e64 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -116,7 +116,7 @@  static inline bool x86_exception_has_error_code(unsigned int vector)
 			BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
 			BIT(PF_VECTOR) | BIT(AC_VECTOR);
 
-	return (1U << vector) & exception_has_error_code;
+	return vector < 32 && (1U << vector) & exception_has_error_code;
 }
 
 static inline bool mmu_is_nested(struct kvm_vcpu *vcpu)