diff options
| author | Jan Kiszka <jan.kiszka@siemens.com> | 2013-09-30 12:35:13 +0200 |
|---|---|---|
| committer | Gleb Natapov <gleb@redhat.com> | 2013-10-04 13:13:16 +0300 |
| commit | 7174e54cf14290233f4ae3e989ebc7b507636e77 (patch) | |
| tree | 368e14461ebaedec159665866011bfb3e779b02c /hw/i386/kvmvapic.c | |
| parent | 2560f19f426aceb4f2e809d860b93e7573cb1c4e (diff) | |
kvmvapic: Prevent reading beyond the end of guest RAM
rom_state_paddr is guest provided (caller address of outw(VAPIC_PORT) +
writen 16-bit value) and can be influenced to point beyond the end of
the host memory backing the guest's RAM. Make sure we do not use this
pointer to actually read beyond the limits.
Reading arbitrary guest bytes is harmless, the guest kernel has to
manage access to this I/O port anyway.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Diffstat (limited to 'hw/i386/kvmvapic.c')
| -rw-r--r-- | hw/i386/kvmvapic.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index 1c2dbf59cf..2d876009fc 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -596,6 +596,9 @@ static int vapic_map_rom_writable(VAPICROMState *s) section = memory_region_find(as, 0, 1); /* read ROM size from RAM region */ + if (rom_paddr + 2 >= memory_region_size(section.mr)) { + return -1; + } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0) { |