On 12/9/21 19:53, Jim Mattson wrote:
How do we know that i < size? For example, Ice Lake supports 4 fixed
counters, but fixed_pmc_events only has three entries.
We don't, and it's a preexisting bug in intel_pmu_refresh.
As Like points out, KVM_GET_SUPPORTED_CPUID indicates that only three
fixed counters are supported. So, per the KVM contract, if userspace
configures four in the guest cpuid info, all bets are off.
Out of bounds accesses are not part of the contract though, even if
squashed by an unorthodox use of array_index_nospec. So I'll post my hack.
I don't like that contract, but changing it means introducing KVM_SET_CPUID3.
And especially it means getting it right, which is the difficult part.
Paolo
