Skip to contentSkip to conversation

KVM: properly check max PIC pin in irq route setup

PATCH Marcelo Tosatti 3 participants 3 messages Jan 12, 2010 – Jan 17, 2010 KVM

lore
Share & tools
lore

Marcelo Tosatti

author
#0 lore raw

Otherwise memory beyond irq_states[16] might be accessed.

Noticed by Juan Quintela.

Signed-off-by Marcelo Tosatti <[email protected]>
virt/kvm/irq_comm.c +5 -1
index 9b07734..9fd5b3e 100644
@@ -302,6 +302,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 {
 	int r = -EINVAL;
 	int delta;
+	unsigned max_pin;
 	struct kvm_kernel_irq_routing_entry *ei;
 	struct hlist_node *n;
 

@@ -322,12 +323,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 		switch (ue->u.irqchip.irqchip) {
 		case KVM_IRQCHIP_PIC_MASTER:
 			e->set = kvm_set_pic_irq;
+			max_pin = 16;
 			break;
 		case KVM_IRQCHIP_PIC_SLAVE:
 			e->set = kvm_set_pic_irq;
+			max_pin = 16;
 			delta = 8;
 			break;
 		case KVM_IRQCHIP_IOAPIC:
+			max_pin = KVM_IOAPIC_NUM_PINS;
 			e->set = kvm_set_ioapic_irq;
 			break;
 		default:

@@ -335,7 +339,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 		}
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin + delta;
-		if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+		if (e->irqchip.pin >= max_pin)
 			goto out;
 		rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
 		break;
Acked-by
#1 lore raw
Quoted 19 lines · Marcelo Tosatti

Otherwise memory beyond irq_states[16] might be accessed.

Noticed by Juan Quintela.

Signed-off-by Marcelo Tosatti <[email protected]>
virt/kvm/irq_comm.c +1 -0
index 9b07734..9fd5b3e 100644
@@ -302,6 +302,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 {
 	int r = -EINVAL;
 	int delta;
+	unsigned max_pin;
 	struct kvm_kernel_irq_routing_entry *ei;
 	struct hlist_node *n;

virt/kvm/irq_comm.c static int setup_routing_entry(struct kvm_irq_routing_table *rt, · line 326

Quoted 4 lines
virt/kvm/irq_comm.c +1 -0
@@ -322,12 +323,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 		switch (ue->u.irqchip.irqchip) {
 		case KVM_IRQCHIP_PIC_MASTER:
 			e->set = kvm_set_pic_irq;
+			max_pin = 16;

once you are here, you can use the constant name:
PIC_NUM_PINS
Humm, that is not going to fly, it is defined in x86 code, and it is used in generic code.

No great ideas here :(

Quoted 12 lines
virt/kvm/irq_comm.c +2 -0
 			break;
 		case KVM_IRQCHIP_PIC_SLAVE:
 			e->set = kvm_set_pic_irq;
+			max_pin = 16;
 			delta = 8;
 			break;
 		case KVM_IRQCHIP_IOAPIC:
+			max_pin = KVM_IOAPIC_NUM_PINS;
 			e->set = kvm_set_ioapic_irq;
 			break;
 		default:

virt/kvm/irq_comm.c static int setup_routing_entry(struct kvm_irq_routing_table *rt, · line 345

Quoted 8 lines
virt/kvm/irq_comm.c +1 -1
@@ -335,7 +339,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 		}
 		e->irqchip.irqchip = ue->u.irqchip.irqchip;
 		e->irqchip.pin = ue->u.irqchip.pin + delta;
-		if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+		if (e->irqchip.pin >= max_pin)
 			goto out;
 		rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
 		break;

For the rest, patch fixes my concerns.

Acked-by Juan Quintela <[email protected]>
#2 lore raw
In reply to Marcelo Tosatti
Quoted 5 lines · Marcelo Tosatti

Otherwise memory beyond irq_states[16] might be accessed.

Noticed by Juan Quintela.

Applied and queued; thanks.

Signature · 1 line
error compiling committee.c: too many arguments to function