Message ID | 20131106144602.GD16072@x1.alien8.de (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Il 06/11/2013 15:46, Borislav Petkov ha scritto: > From: Borislav Petkov <bp@suse.de> > Subject: [PATCH] kvm, cpuid: Fix sparse warning > > We need to copy padding to kernel space first before looking at it. > > Reported-by: kbuild test robot <fengguang.wu@intel.com> > Signed-off-by: Borislav Petkov <bp@suse.de> > --- > arch/x86/kvm/cpuid.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c > index 8f66fba804e4..c6976257eff5 100644 > --- a/arch/x86/kvm/cpuid.c > +++ b/arch/x86/kvm/cpuid.c > @@ -564,6 +564,7 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, > __u32 num_entries, unsigned int ioctl_type) > { > int i; > + __u32 pad[3]; > > if (ioctl_type != KVM_GET_EMULATED_CPUID) > return false; > @@ -577,9 +578,10 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, > * sheds a tear. > */ > for (i = 0; i < num_entries; i++) { > - if (entries[i].padding[0] || > - entries[i].padding[1] || > - entries[i].padding[2]) > + if (copy_from_user(pad, entries[i].padding, sizeof(pad))) > + return true; > + > + if (pad[0] || pad[1] || pad[2]) > return true; > } > return false; > Applied by Gleb -- thanks. Paolo -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 8f66fba804e4..c6976257eff5 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -564,6 +564,7 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, __u32 num_entries, unsigned int ioctl_type) { int i; + __u32 pad[3]; if (ioctl_type != KVM_GET_EMULATED_CPUID) return false; @@ -577,9 +578,10 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, * sheds a tear. */ for (i = 0; i < num_entries; i++) { - if (entries[i].padding[0] || - entries[i].padding[1] || - entries[i].padding[2]) + if (copy_from_user(pad, entries[i].padding, sizeof(pad))) + return true; + + if (pad[0] || pad[1] || pad[2]) return true; } return false;