Commit 332fa4a8 authored by Björn Töpel's avatar Björn Töpel Committed by Anup Patel
Browse files

riscv: kvm: Fix out-of-bounds array access 



In kvm_riscv_vcpu_sbi_init() the entry->ext_idx can contain an
out-of-bound index. This is used as a special marker for the base
extensions, that cannot be disabled. However, when traversing the
extensions, that special marker is not checked prior indexing the
array.

Add an out-of-bounds check to the function.

Fixes: 56d8a385 ("RISC-V: KVM: Allow some SBI extensions to be disabled by default")
Signed-off-by: default avatarBjörn Töpel <bjorn@rivosinc.com>
Reviewed-by: default avatarAnup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20241104191503.74725-1-bjorn@kernel.org


Signed-off-by: default avatarAnup Patel <anup@brainfault.org>
parent 60821fb4

arch/riscv/kvm/vcpu_sbi.c

+7 −4
Original line number Diff line number Diff line
@@ -486,19 +486,22 @@ void kvm_riscv_vcpu_sbi_init(struct kvm_vcpu *vcpu) 
	struct kvm_vcpu_sbi_context *scontext = &vcpu->arch.sbi_context;

	const struct kvm_riscv_sbi_extension_entry *entry;

	const struct kvm_vcpu_sbi_extension *ext;

	int i;

	int idx, i;



	for (i = 0; i < ARRAY_SIZE(sbi_ext); i++) {

		entry = &sbi_ext[i];

		ext = entry->ext_ptr;

		idx = entry->ext_idx;



		if (idx < 0 || idx >= ARRAY_SIZE(scontext->ext_status))

			continue;



		if (ext->probe && !ext->probe(vcpu)) {

			scontext->ext_status[entry->ext_idx] =

				KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;

			scontext->ext_status[idx] = KVM_RISCV_SBI_EXT_STATUS_UNAVAILABLE;

			continue;

		}



		scontext->ext_status[entry->ext_idx] = ext->default_disabled ?

		scontext->ext_status[idx] = ext->default_disabled ?

					KVM_RISCV_SBI_EXT_STATUS_DISABLED :

					KVM_RISCV_SBI_EXT_STATUS_ENABLED;

	}