iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KVM: arm64: its: Fix missing dynamic allocation check in scan_its_table

Browse Source 
We currently allocate an entry dynamically, but we never check if the
allocation actually succeeded.  We actually don't need a dynamic
allocation, because we know the maximum size of an ITS table entry, so
we can simply use an allocation on the stack.

Cc: <stable@vger.kernel.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
This commit is contained in:
Christoffer Dall 2017-10-13 11:40:11 +02:00
parent 8a5776a5f4
commit 8c1a8a3243
1 changed files with 7 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
virt/kvm/arm/vgic/vgic-its.c
View File

@ -1801,37 +1801,33 @@ typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry,
static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz, static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz,
int start_id, entry_fn_t fn, void *opaque) int start_id, entry_fn_t fn, void *opaque)
{ {
void *entry = kzalloc(esz, GFP_KERNEL);
struct kvm *kvm = its->dev->kvm; struct kvm *kvm = its->dev->kvm;
unsigned long len = size; unsigned long len = size;
int id = start_id; int id = start_id;
gpa_t gpa = base; gpa_t gpa = base;
char entry[esz];
int ret; int ret;
memset(entry, 0, esz);
while (len > 0) { while (len > 0) {
int next_offset; int next_offset;
size_t byte_offset; size_t byte_offset;
ret = kvm_read_guest(kvm, gpa, entry, esz); ret = kvm_read_guest(kvm, gpa, entry, esz);
if (ret) if (ret)
goto out; return ret;
next_offset = fn(its, id, entry, opaque); next_offset = fn(its, id, entry, opaque);
if (next_offset <= 0) { if (next_offset <= 0)
ret = next_offset; return next_offset;
goto out;
}
byte_offset = next_offset * esz; byte_offset = next_offset * esz;
id += next_offset; id += next_offset;
gpa += byte_offset; gpa += byte_offset;
len -= byte_offset; len -= byte_offset;
} }
ret = 1; return 1;
out:
kfree(entry);
return ret;
} }
/** /**