CVE-2015-XXXX kvm: NULL ptr deref in kvm_apic_has_events (rhbz 1230770 1230774)
This commit is contained in:
parent
8cd63a28c3
commit
f7efdbdd4d
|
@ -699,6 +699,9 @@ Patch26238: Input-Revert-Revert-synaptics-use-dmax-in-input_mt_a.patch
|
|||
Patch26239: Input-synaptics-allocate-3-slots-to-keep-stability-i.patch
|
||||
Patch26240: Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
|
||||
|
||||
# CVE-2015-XXXX rhbz 1230770 1230774
|
||||
Patch26241: kvm-x86-fix-kvm_apic_has_events-to-check-for-NULL-po.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
@ -1513,6 +1516,9 @@ ApplyPatch Input-Revert-Revert-synaptics-use-dmax-in-input_mt_a.patch
|
|||
ApplyPatch Input-synaptics-allocate-3-slots-to-keep-stability-i.patch
|
||||
ApplyPatch Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
|
||||
|
||||
# CVE-2015-XXXX rhbz 1230770 1230774
|
||||
ApplyPatch kvm-x86-fix-kvm_apic_has_events-to-check-for-NULL-po.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2363,6 +2369,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Fri Jun 12 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- CVE-2015-XXXX kvm: NULL ptr deref in kvm_apic_has_events (rhbz 1230770 1230774)
|
||||
|
||||
* Thu Jun 11 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Backport fixes for synaptic 3 finger tap (rhbz 1212230)
|
||||
- Backport btrfs fixes queued for stable (rhbz 1217191)
|
||||
|
|
|
@ -0,0 +1,25 @@
|
|||
From: Paolo Bonzini <pbonzini@redhat.com>
|
||||
Date: Thu, 4 Jun 2015 10:18:22 +0200
|
||||
Subject: [PATCH] kvm: x86: fix kvm_apic_has_events to check for NULL pointer
|
||||
|
||||
Malicious (or egregiously buggy) userspace can trigger it, but it
|
||||
should never happen in normal operation.
|
||||
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
---
|
||||
arch/x86/kvm/lapic.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
|
||||
index 0bc6c656625b..ca4f92d56e16 100644
|
||||
--- a/arch/x86/kvm/lapic.h
|
||||
+++ b/arch/x86/kvm/lapic.h
|
||||
@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
|
||||
|
||||
static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
|
||||
{
|
||||
- return vcpu->arch.apic->pending_events;
|
||||
+ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
|
||||
}
|
||||
|
||||
bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
|
Loading…
Reference in New Issue