linux/virt/kvm
Paolo Bonzini 5678de3f15 KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
QE reported that they got the BUG_ON in ioapic_service to trigger.
I cannot reproduce it, but there are two reasons why this could happen.

The less likely but also easiest one, is when kvm_irq_delivery_to_apic
does not deliver to any APIC and returns -1.

Because irqe.shorthand == 0, the kvm_for_each_vcpu loop in that
function is never reached.  However, you can target the similar loop in
kvm_irq_delivery_to_apic_fast; just program a zero logical destination
address into the IOAPIC, or an out-of-range physical destination address.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-04 17:17:14 +02:00
..
arm arm64: KVM: Add VGIC device control for arm64 2014-02-14 11:09:49 +01:00
assigned-dev.c KVM: Move irq routing to generic code 2013-04-26 20:27:17 +02:00
async_pf.c KVM: async_pf: Add missing call for async page present 2014-02-04 04:24:05 +01:00
async_pf.h KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
coalesced_mmio.c KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio() 2014-01-30 11:56:09 +01:00
coalesced_mmio.h KVM: Make coalesced mmio use a device per zone 2011-09-25 19:17:57 +03:00
eventfd.c KVM: eventfd: Fix lock order inversion. 2014-03-18 17:06:04 +01:00
ioapic.c KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155) 2014-04-04 17:17:14 +02:00
ioapic.h kvm: make local functions static 2014-01-08 19:02:58 -02:00
iodev.h KVM: remove in_range from io devices 2009-09-10 08:33:05 +03:00
iommu.c KVM: IOMMU: hva align mapping page size 2013-11-05 09:55:36 +02:00
irq_comm.c KVM: Fix RTC interrupt coalescing tracking 2013-06-27 14:20:53 +03:00
irqchip.c KVM: Move irq routing setup to irqchip.c 2013-04-26 20:27:18 +02:00
Kconfig KVM: async_pf: Provide additional direct page notification 2014-01-30 12:51:38 +01:00
kvm_main.c Merge tag 'kvm-3.15-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm 2014-04-02 14:50:10 -07:00
vfio.c kvm: vfio: silence GCC warning 2014-01-15 12:01:48 +01:00