Commit 2e3272bc authored by Alexander Graf's avatar Alexander Graf Committed by Paolo Bonzini

KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter()

In the next patch we want to introduce a second caller to
set_msr_filter() which constructs its own filter list on the stack.
Refactor the original function so it takes it as argument instead of
reading it through copy_from_user().
Signed-off-by: default avatarAlexander Graf <graf@amazon.com>
Message-Id: <20221017184541.2658-3-graf@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent ed51862f
...@@ -6442,26 +6442,22 @@ static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter, ...@@ -6442,26 +6442,22 @@ static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter,
return 0; return 0;
} }
static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm,
struct kvm_msr_filter *filter)
{ {
struct kvm_msr_filter __user *user_msr_filter = argp;
struct kvm_x86_msr_filter *new_filter, *old_filter; struct kvm_x86_msr_filter *new_filter, *old_filter;
struct kvm_msr_filter filter;
bool default_allow; bool default_allow;
bool empty = true; bool empty = true;
int r = 0; int r = 0;
u32 i; u32 i;
if (copy_from_user(&filter, user_msr_filter, sizeof(filter))) if (filter->flags & ~KVM_MSR_FILTER_DEFAULT_DENY)
return -EFAULT;
if (filter.flags & ~KVM_MSR_FILTER_DEFAULT_DENY)
return -EINVAL; return -EINVAL;
for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) for (i = 0; i < ARRAY_SIZE(filter->ranges); i++)
empty &= !filter.ranges[i].nmsrs; empty &= !filter->ranges[i].nmsrs;
default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY); default_allow = !(filter->flags & KVM_MSR_FILTER_DEFAULT_DENY);
if (empty && !default_allow) if (empty && !default_allow)
return -EINVAL; return -EINVAL;
...@@ -6469,8 +6465,8 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp) ...@@ -6469,8 +6465,8 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
if (!new_filter) if (!new_filter)
return -ENOMEM; return -ENOMEM;
for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) { for (i = 0; i < ARRAY_SIZE(filter->ranges); i++) {
r = kvm_add_msr_filter(new_filter, &filter.ranges[i]); r = kvm_add_msr_filter(new_filter, &filter->ranges[i]);
if (r) { if (r) {
kvm_free_msr_filter(new_filter); kvm_free_msr_filter(new_filter);
return r; return r;
...@@ -6915,9 +6911,16 @@ long kvm_arch_vm_ioctl(struct file *filp, ...@@ -6915,9 +6911,16 @@ long kvm_arch_vm_ioctl(struct file *filp,
case KVM_SET_PMU_EVENT_FILTER: case KVM_SET_PMU_EVENT_FILTER:
r = kvm_vm_ioctl_set_pmu_event_filter(kvm, argp); r = kvm_vm_ioctl_set_pmu_event_filter(kvm, argp);
break; break;
case KVM_X86_SET_MSR_FILTER: case KVM_X86_SET_MSR_FILTER: {
r = kvm_vm_ioctl_set_msr_filter(kvm, argp); struct kvm_msr_filter __user *user_msr_filter = argp;
struct kvm_msr_filter filter;
if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))
return -EFAULT;
r = kvm_vm_ioctl_set_msr_filter(kvm, &filter);
break; break;
}
default: default:
r = -ENOTTY; r = -ENOTTY;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment