rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CVE-2015-XXXX kvm: NULL ptr deref in kvm_apic_has_events (rhbz 1230770 1230774)

This commit is contained in:
Josh Boyer 2015-06-12 10:15:55 -04:00
parent 51b05b43fb
commit 97d8c53ad3
2 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel.spec
View File

@ -701,6 +701,9 @@ Patch26238: Input-Revert-Revert-synaptics-use-dmax-in-input_mt_a.patch
Patch26239: Input-synaptics-allocate-3-slots-to-keep-stability-i.patch
Patch26240: Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
# CVE-2015-XXXX rhbz 1230770 1230774
Patch26241: kvm-x86-fix-kvm_apic_has_events-to-check-for-NULL-po.patch
# END OF PATCH DEFINITIONS
%endif
@ -1505,6 +1508,9 @@ ApplyPatch Input-Revert-Revert-synaptics-use-dmax-in-input_mt_a.patch
ApplyPatch Input-synaptics-allocate-3-slots-to-keep-stability-i.patch
ApplyPatch Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
# CVE-2015-XXXX rhbz 1230770 1230774
ApplyPatch kvm-x86-fix-kvm_apic_has_events-to-check-for-NULL-po.patch
# END OF PATCH APPLICATIONS
%endif
@ -2364,6 +2370,9 @@ fi
# ||----w |
# || ||
%changelog
* Fri Jun 12 2015 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2015-XXXX kvm: NULL ptr deref in kvm_apic_has_events (rhbz 1230770 1230774)
* Thu Jun 11 2015 Josh Boyer <jwboyer@fedoraproject.org>
- Backport fixes for synaptic 3 finger tap (rhbz 1212230)
- Backport btrfs fixes queued for stable (rhbz 1217191)

25
kvm-x86-fix-kvm_apic_has_events-to-check-for-NULL-po.patch Normal file
View File

@ -0,0 +1,25 @@
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 4 Jun 2015 10:18:22 +0200
Subject: [PATCH] kvm: x86: fix kvm_apic_has_events to check for NULL pointer
Malicious (or egregiously buggy) userspace can trigger it, but it
should never happen in normal operation.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/lapic.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
index 0bc6c656625b..ca4f92d56e16 100644
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
{
- return vcpu->arch.apic->pending_events;
+ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
}
bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);