mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-06 02:24:14 +08:00
338c7dbadd
In multiple functions the vcpu_id is used as an offset into a bitfield. Ag malicious user could specify a vcpu_id greater than 255 in order to set or clear bits in kernel memory. This could be used to elevate priveges in the kernel. This patch verifies that the vcpu_id provided is less than 255. The api documentation already specifies that the vcpu_id must be less than max_vcpus, but this is currently not checked. Reported-by: Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
---|---|---|
.. | ||
arm | ||
assigned-dev.c | ||
async_pf.c | ||
async_pf.h | ||
coalesced_mmio.c | ||
coalesced_mmio.h | ||
eventfd.c | ||
ioapic.c | ||
ioapic.h | ||
iodev.h | ||
iommu.c | ||
irq_comm.c | ||
irqchip.c | ||
Kconfig | ||
kvm_main.c | ||
vfio.c |