Commit ef7e0c51 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

Merge tag 'kvm-s390-master-7.1-1' of... 

Merge tag 'kvm-s390-master-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

KVM: s390: pci: fix array indexing

For large amounts of PCI devices its possible to overrun the arrays as
the index was miscalculated in 2 places.
parents 3098c076 0cfe6605

arch/s390/kvm/interrupt.c

+1 −2
Original line number Diff line number Diff line
@@ -3310,8 +3310,7 @@ static void aen_host_forward(unsigned long si) 
	struct zpci_gaite *gaite;

	struct kvm *kvm;



	gaite = (struct zpci_gaite *)aift->gait +

		(si * sizeof(struct zpci_gaite));

	gaite = aift->gait + si;

	if (gaite->count == 0)

		return;

	if (gaite->aisb != 0)

arch/s390/kvm/pci.c

+4 −6
Original line number Diff line number Diff line
@@ -166,7 +166,7 @@ static int kvm_zpci_set_airq(struct zpci_dev *zdev) 
	fib.fmt0.noi = airq_iv_end(zdev->aibv);

	fib.fmt0.aibv = virt_to_phys(zdev->aibv->vector);

	fib.fmt0.aibvo = 0;

	fib.fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8);

	fib.fmt0.aisb = virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * 8;

	fib.fmt0.aisbo = zdev->aisb & 63;

	fib.gd = zdev->gisa;
@@ -290,8 +290,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, 
				    phys_to_virt(fib->fmt0.aibv));



	spin_lock_irq(&aift->gait_lock);

	gaite = (struct zpci_gaite *)aift->gait + (zdev->aisb *

						   sizeof(struct zpci_gaite));

	gaite = aift->gait + zdev->aisb;



	/* If assist not requested, host will get all alerts */

	if (assist)
@@ -309,7 +308,7 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, 


	/* Update guest FIB for re-issue */

	fib->fmt0.aisbo = zdev->aisb & 63;

	fib->fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8);

	fib->fmt0.aisb = virt_to_phys(aift->sbv->vector) + (zdev->aisb / 64) * 8;

	fib->fmt0.isc = gisc;



	/* Save some guest fib values in the host for later use */
@@ -357,8 +356,7 @@ static int kvm_s390_pci_aif_disable(struct zpci_dev *zdev, bool force) 
	if (zdev->kzdev->fib.fmt0.aibv == 0)

		goto out;

	spin_lock_irq(&aift->gait_lock);

	gaite = (struct zpci_gaite *)aift->gait + (zdev->aisb *

						   sizeof(struct zpci_gaite));

	gaite = aift->gait + zdev->aisb;

	isc = gaite->gisc;

	gaite->count--;

	if (gaite->count == 0) {