]> git.baikalelectronics.ru Git - kernel.git/commit
kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
authorJim Mattson <jmattson@google.com>
Wed, 26 Oct 2016 15:38:38 +0000 (08:38 -0700)
committerPaolo Bonzini <pbonzini@redhat.com>
Thu, 27 Oct 2016 10:15:27 +0000 (12:15 +0200)
commit2ef2bf53c7485f8c11c02f2ba791accd228588e9
tree54e99503fc7d4abc2d6b573099566428c864c0d0
parent2b699b1cb34d3cdccdf195b8e96db48c3b7e186e
kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types

Bitwise shifts by amounts greater than or equal to the width of the left
operand are undefined. A malicious guest can exploit this to crash a
32-bit host, due to the BUG_ON(1)'s in handle_{invept,invvpid}.

Signed-off-by: Jim Mattson <jmattson@google.com>
Message-Id: <1477496318-17681-1-git-send-email-jmattson@google.com>
[Change 1UL to 1, to match the range check on the shift count. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/vmx.c