Commit 1893c941 authored Mar 02, 2020 by Sean Christopherson Committed by Paolo Bonzini Mar 16, 2020

KVM: x86: Check for CPUID 0xD.N support before validating array size



Now that sub-leaf 1 is handled separately, verify the next sub-leaf is
needed before rejecting KVM_GET_SUPPORTED_CPUID due to an insufficiently
sized userspace array.

Note, although this is technically a bug, it's not visible to userspace
as KVM_GET_SUPPORTED_CPUID is guaranteed to fail on KVM_CPUID_SIGNATURE,
which is hardcoded to be added after leaf 0xD.  The real motivation for
the change is to tightly couple the nent/maxnent and do_host_cpuid()
sequences in preparation for future cleanup.

Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 3dc4a9cf

arch/x86/kvm/cpuid.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -670,13 +670,14 @@ static inline int __do_cpuid_func(struct kvm_cpuid_entry2 *entry, u32 function,
		entry[1].edx = 0;

		for (idx = 2, i = 2; idx < 64; ++idx) {
		u64 mask = ((u64)1 << idx);
		if (!(supported & BIT_ULL(idx)))
		continue;

		if (*nent >= maxnent)
		goto out;

		do_host_cpuid(&entry[i], function, idx);
		if (entry[i].eax == 0 \|\| !(supported & mask))
		if (entry[i].eax == 0)
		continue;
		if (WARN_ON_ONCE(entry[i].ecx & 1))
		continue;

Admin message