Skip to content

Commit a2162e0

Browse files
gregkhaloktiwa
authored andcommitted
kvm: initialize all of the kvm_debugregs structure before sending it to userspace
commit 2c10b61 upstream. When calling the KVM_GET_DEBUGREGS ioctl, on some configurations, there might be some unitialized portions of the kvm_debugregs structure that could be copied to userspace. Prevent this as is done in the other kvm ioctls, by setting the whole structure to 0 before copying anything into it. Bonus is that this reduces the lines of code as the explicit flag setting and reserved space zeroing out can be removed. Cc: Sean Christopherson <seanjc@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: <x86@kernel.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: stable <stable@kernel.org> Reported-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Message-Id: <20230214103304.3689213-1-gregkh@linuxfoundation.org> Tested-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1d43de93b35d85981006ec3c52c0cad8af1f2f6a) Orabug: 35250098 CVE: CVE-2023-1513 Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
1 parent ede430a commit a2162e0

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

arch/x86/kvm/x86.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3291,12 +3291,11 @@ static void kvm_vcpu_ioctl_x86_get_debugregs(struct kvm_vcpu *vcpu,
32913291
{
32923292
unsigned long val;
32933293

3294+
memset(dbgregs, 0, sizeof(*dbgregs));
32943295
memcpy(dbgregs->db, vcpu->arch.db, sizeof(vcpu->arch.db));
32953296
kvm_get_dr(vcpu, 6, &val);
32963297
dbgregs->dr6 = val;
32973298
dbgregs->dr7 = vcpu->arch.dr7;
3298-
dbgregs->flags = 0;
3299-
memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
33003299
}
33013300

33023301
static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,

0 commit comments

Comments
 (0)