On 22/08/2018 12:18, Vitaly Kuznetsov wrote:
> Hyper-V TLFS (5.0b) states:
>
>> Virtual processors are identified by using an index (VP index). The
>> maximum number of virtual processors per partition supported by the
>> current implementation of the hypervisor can be obtained through CPUID
>> leaf 0x40000005. A virtual processor index must be less than the
>> maximum number of virtual processors per partition.
>
> Forbid userspace to set VP_INDEX above KVM_MAX_VCPUS. get_vcpu_by_vpidx()
> can now be optimized to bail early when supplied vpidx is >= KVM_MAX_VCPUS.
>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>
> Reviewed-by: Roman Kagan <rkagan@xxxxxxxxxxxxx>
> ---
> arch/x86/kvm/hyperv.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
> index 01d209ab5481..0cd597b0f754 100644
> --- a/arch/x86/kvm/hyperv.c
> +++ b/arch/x86/kvm/hyperv.c
> @@ -132,8 +132,10 @@ static struct kvm_vcpu *get_vcpu_by_vpidx(struct kvm *kvm, u32 vpidx)
> struct kvm_vcpu *vcpu = NULL;
> int i;
>
> - if (vpidx < KVM_MAX_VCPUS)
> - vcpu = kvm_get_vcpu(kvm, vpidx);
> + if (vpidx >= KVM_MAX_VCPUS)
> + return NULL;
> +
> + vcpu = kvm_get_vcpu(kvm, vpidx);
> if (vcpu && vcpu_to_hv_vcpu(vcpu)->vp_index == vpidx)
> return vcpu;
> kvm_for_each_vcpu(i, vcpu, kvm)
> @@ -1044,7 +1046,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
>
> switch (msr) {
> case HV_X64_MSR_VP_INDEX:
> - if (!host)
> + if (!host || (u32)data >= KVM_MAX_VCPUS)
> return 1;
> hv->vp_index = (u32)data;
> break;
>
Queued, thanks.
Paolo
