mirror of https://gitee.com/openkylin/linux.git
kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
Bitwise shifts by amounts greater than or equal to the width of the left operand are undefined. A malicious guest can exploit this to crash a 32-bit host, due to the BUG_ON(1)'s in handle_{invept,invvpid}. Signed-off-by: Jim Mattson <jmattson@google.com> Message-Id: <1477496318-17681-1-git-send-email-jmattson@google.com> [Change 1UL to 1, to match the range check on the shift count. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
58e3948a87
commit
85c856b39b
|
@ -7659,7 +7659,7 @@ static int handle_invept(struct kvm_vcpu *vcpu)
|
|||
|
||||
types = (vmx->nested.nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;
|
||||
|
||||
if (!(types & (1UL << type))) {
|
||||
if (type >= 32 || !(types & (1 << type))) {
|
||||
nested_vmx_failValid(vcpu,
|
||||
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
|
||||
skip_emulated_instruction(vcpu);
|
||||
|
@ -7722,7 +7722,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
|
|||
|
||||
types = (vmx->nested.nested_vmx_vpid_caps >> 8) & 0x7;
|
||||
|
||||
if (!(types & (1UL << type))) {
|
||||
if (type >= 32 || !(types & (1 << type))) {
|
||||
nested_vmx_failValid(vcpu,
|
||||
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
|
||||
skip_emulated_instruction(vcpu);
|
||||
|
|
Loading…
Reference in New Issue