Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map

2016-11-24 Thread David Hildenbrand
Am 23.11.2016 um 21:15 schrieb Radim Krčmář: KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be bigger that the maximal number of VCPUs, resulting in out-of-bounds access. Found by syzkaller: BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...] W

Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map

2016-11-23 Thread P J P
+-- On Wed, 23 Nov 2016, Paolo Bonzini wrote --+ | On 23/11/2016 21:15, Radim Krčmář wrote: | > KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be | > bigger that the maximal number of VCPUs, resulting in out-of-bounds | > access. | > | > Found by syzkaller: | > | > BUG: KAS

Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map

2016-11-23 Thread Paolo Bonzini
On 23/11/2016 21:15, Radim Krčmář wrote: > KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be > bigger that the maximal number of VCPUs, resulting in out-of-bounds > access. > > Found by syzkaller: > > BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr

[PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map

2016-11-23 Thread Radim Krčmář
KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be bigger that the maximal number of VCPUs, resulting in out-of-bounds access. Found by syzkaller: BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...] Write of size 1 by task a.out/27101 CPU: 1 PID