tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

RISC-V: KVM: fix off-by-one array access in SBI PMU

The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest,
but it could only access another guest accessible data.

Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260227134617.23378-1-radim.krcmar@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>

authored by

Radim Krčmář and committed by
Anup Patel 5c1bb078 c28eb189

+1 -1
+1 -1
arch/riscv/kvm/vcpu_pmu.c
··· 520 520 { 521 521 struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu); 522 522 523 - if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) { 523 + if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) { 524 524 retdata->err_val = SBI_ERR_INVALID_PARAM; 525 525 return 0; 526 526 }