kevin/linux
1
Fork 0
Code

KVM: selftests: Fix out-of-bounds reads in CPUID test's array lookups

Browse Source 
When looking for a "mangled", i.e. dynamic, CPUID entry, terminate the
walk based on the number of array _entries_, not the size in bytes of
the array.  Iterating based on the total size of the array can result in
false passes, e.g. if the random data beyond the array happens to match
a CPUID entry's function and index.

Fixes: fb18d053b7 ("selftest: kvm: x86: test KVM_GET_CPUID2 and guest visible CPUIDs against KVM_GET_SUPPORTED_CPUID")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-ID: <20241003234337.273364-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Sean Christopherson 2024-10-03 16:43:27 -07:00 committed by Paolo Bonzini
parent 9a400068a1
commit 773cca1834
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/testing/selftests/kvm/x86_64/cpuid_test.c
View File

@ -60,7 +60,7 @@ static bool is_cpuid_mangled(const struct kvm_cpuid_entry2 *entrie)
{ {
int i; int i;
for (i = 0; i < sizeof(mangled_cpuids); i++) { for (i = 0; i < ARRAY_SIZE(mangled_cpuids); i++) {
if (mangled_cpuids[i].function == entrie->function && if (mangled_cpuids[i].function == entrie->function &&
mangled_cpuids[i].index == entrie->index) mangled_cpuids[i].index == entrie->index)
return true; return true;