Commit 5c1bb078 authored by Radim Krčmář's avatar Radim Krčmář Committed by Anup Patel
Browse files

RISC-V: KVM: fix off-by-one array access in SBI PMU 



The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest,
but it could only access another guest accessible data.

Fixes: 8f0153ec ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: default avatarRadim Krčmář <radim.krcmar@oss.qualcomm.com>
Reviewed-by: default avatarAnup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260227134617.23378-1-radim.krcmar@oss.qualcomm.com


Signed-off-by: default avatarAnup Patel <anup@brainfault.org>
parent c28eb189

arch/riscv/kvm/vcpu_pmu.c

+1 −1
Original line number Diff line number Diff line
@@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx, 
{

	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);



	if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {

	if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {

		retdata->err_val = SBI_ERR_INVALID_PARAM;

		return 0;

	}