KVM: S390: fix potential array overrun in intercept handling
kvm_handle_sie_intercept uses a jump table to get the intercept handler for a SIE intercept. Static code analysis revealed a potential problem: the intercept_funcs jump table was defined to contain (0x48 >> 2) entries, but we only checked for code > 0x48 which would cause an off-by-one array overflow if code == 0x48. Use the compiler and ARRAY_SIZE to automatically set the limits. Cc: stable@kernel.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
This commit is contained in:
parent
b6a114d272
commit
062d5e9b0d
|
@ -213,7 +213,7 @@ static int handle_instruction_and_prog(struct kvm_vcpu *vcpu)
|
|||
return rc2;
|
||||
}
|
||||
|
||||
static const intercept_handler_t intercept_funcs[0x48 >> 2] = {
|
||||
static const intercept_handler_t intercept_funcs[] = {
|
||||
[0x00 >> 2] = handle_noop,
|
||||
[0x04 >> 2] = handle_instruction,
|
||||
[0x08 >> 2] = handle_prog,
|
||||
|
@ -230,7 +230,7 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu)
|
|||
intercept_handler_t func;
|
||||
u8 code = vcpu->arch.sie_block->icptcode;
|
||||
|
||||
if (code & 3 || code > 0x48)
|
||||
if (code & 3 || (code >> 2) >= ARRAY_SIZE(intercept_funcs))
|
||||
return -ENOTSUPP;
|
||||
func = intercept_funcs[code >> 2];
|
||||
if (func)
|
||||
|
|
Loading…
Reference in New Issue