2012-08-20 14:26:17

by Alan

Subject: [PATCH RESEND] kvm: Fix nonsense handling of compat ioctl

From: Alan Cox <[email protected]>

KVM_SET_SIGNAL_MASK passed a NULL argument leaves the on stack signal
sets uninitialized. It then passes them through to
kvm_vcpu_ioctl_set_sigmask.

We should be passing a NULL in this case not translated garbage.

Signed-off-by: Alan Cox <[email protected]>
---

virt/kvm/kvm_main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a2e85af..e47a7ca 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1975,9 +1975,10 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
if (copy_from_user(&csigset, sigmask_arg->sigset,
sizeof csigset))
goto out;
- }
- sigset_from_compat(&sigset, &csigset);
- r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
+ sigset_from_compat(&sigset, &csigset);
+ r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
+ } else
+ kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
break;
}
default:

2012-08-22 12:22:55

by Avi Kivity

Subject: Re: [PATCH RESEND] kvm: Fix nonsense handling of compat ioctl

On 08/20/2012 05:43 PM, Alan Cox wrote:
> From: Alan Cox <[email protected]>
>
> KVM_SET_SIGNAL_MASK passed a NULL argument leaves the on stack signal
> sets uninitialized. It then passes them through to
> kvm_vcpu_ioctl_set_sigmask.
>
> We should be passing a NULL in this case not translated garbage.
>
> Signed-off-by: Alan Cox <[email protected]>
> ---
>
> virt/kvm/kvm_main.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index a2e85af..e47a7ca 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1975,9 +1975,10 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
> if (copy_from_user(&csigset, sigmask_arg->sigset,
> sizeof csigset))
> goto out;
> - }
> - sigset_from_compat(&sigset, &csigset);
> - r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
> + sigset_from_compat(&sigset, &csigset);
> + r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
> + } else
> + kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
> break;
> }

Now r is uninitiali[sz]ed.


--
error compiling committee.c: too many arguments to function