Skip to content

Commit 994a375

Browse files
yonghuahlijinxia
yonghuah
authored and
lijinxia
committed
HV:fix potential buffer overflow issues
 - use sizeof(struct lapic_regs),instead of arbitrary size to lear 'apic_page' memory region in vlapic.c - fix potential buffer overflow issues in vpic.c & ioapic.c Tracked-On: #1252 Signed-off-by: Yonghua Huang <yonghua.huang@intel.com> Acked-by: Eddie Dong <eddie.dong@intel.com>
1 parent b501ce4 commit 994a375

File tree

4 files changed

+42
-105
lines changed

4 files changed

+42
-105
lines changed

‎hypervisor/arch/x86/guest/vlapic.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1562,7 +1562,7 @@ vlapic_reset(struct acrn_vlapic *vlapic)
15621562
struct lapic_regs *lapic;
15631563

15641564
lapic = &(vlapic->apic_page);
1565-
(void)memset((void *)lapic, 0U, CPU_PAGE_SIZE);
1565+
(void)memset((void *)lapic, 0U, sizeof(struct lapic_regs));
15661566
(void)memset((void *)&(vlapic->pir_desc), 0U, sizeof(vlapic->pir_desc));
15671567

15681568
lapic->id.v = vlapic_build_id(vlapic);

‎hypervisor/arch/x86/ioapic.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -289,14 +289,17 @@ uint32_t pin_to_irq(uint8_t pin)
289289
void
290290
irq_gsi_mask_unmask(uint32_t irq, bool mask)
291291
{
292-
void *addr = gsi_table[irq].addr;
293-
uint8_t pin = gsi_table[irq].pin;
292+
void *addr;
293+
uint8_t pin;
294294
union ioapic_rte rte;
295295

296296
if (!irq_is_gsi(irq)) {
297297
return;
298298
}
299299

300+
addr = gsi_table[irq].addr;
301+
pin = gsi_table[irq].pin;
302+
300303
ioapic_get_rte_entry(addr, pin, &rte);
301304
if (mask) {
302305
rte.full |= IOAPIC_RTE_INTMSET;

‎hypervisor/dm/vpic.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,6 +412,10 @@ static void vpic_set_pinstate(struct acrn_vpic *vpic, uint8_t pin, bool newstate
412412
int oldcnt, newcnt;
413413
bool level;
414414

415+
if (pin >= NR_VPIC_PINS_TOTAL) {
416+
return;
417+
}
418+
415419
i8259 = &vpic->i8259[pin >> 3U];
416420

417421
oldcnt = i8259->acnt[pin & 0x7U];
@@ -457,6 +461,10 @@ static void vpic_set_irqstate(struct vm *vm, uint32_t irq,
457461
struct i8259_reg_state *i8259;
458462
uint8_t pin;
459463

464+
if (irq >= NR_VPIC_PINS_TOTAL) {
465+
return;
466+
}
467+
460468
vpic = vm_pic(vm);
461469
i8259 = &vpic->i8259[irq >> 3U];
462470
pin = (uint8_t)irq;

‎hypervisor/include/arch/x86/apicreg.h

Lines changed: 28 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -33,83 +33,6 @@
3333
* Local && I/O APIC definitions.
3434
*/
3535

36-
/*
37-
* Pentium P54C+ Built-in APIC
38-
* (Advanced programmable Interrupt Controller)
39-
*
40-
* Base Address of Built-in APIC in memory location
41-
* is 0xfee00000.
42-
*
43-
* Map of APIC Registers:
44-
*
45-
* Offset (hex) Description Read/Write state
46-
* 000 Reserved
47-
* 010 Reserved
48-
* 020 ID Local APIC ID R/W
49-
* 030 VER Local APIC Version R
50-
* 040 Reserved
51-
* 050 Reserved
52-
* 060 Reserved
53-
* 070 Reserved
54-
* 080 Task Priority Register R/W
55-
* 090 Arbitration Priority Register R
56-
* 0A0 Processor Priority Register R
57-
* 0B0 EOI Register W
58-
* 0C0 RRR Remote read R
59-
* 0D0 Logical Destination R/W
60-
* 0E0 Destination Format Register 0..27 R; 28..31 R/W
61-
* 0F0 SVR Spurious Interrupt Vector Reg. 0..3 R; 4..9 R/W
62-
* 100 ISR 000-031 R
63-
* 110 ISR 032-063 R
64-
* 120 ISR 064-095 R
65-
* 130 ISR 095-128 R
66-
* 140 ISR 128-159 R
67-
* 150 ISR 160-191 R
68-
* 160 ISR 192-223 R
69-
* 170 ISR 224-255 R
70-
* 180 TMR 000-031 R
71-
* 190 TMR 032-063 R
72-
* 1A0 TMR 064-095 R
73-
* 1B0 TMR 095-128 R
74-
* 1C0 TMR 128-159 R
75-
* 1D0 TMR 160-191 R
76-
* 1E0 TMR 192-223 R
77-
* 1F0 TMR 224-255 R
78-
* 200 IRR 000-031 R
79-
* 210 IRR 032-063 R
80-
* 220 IRR 064-095 R
81-
* 230 IRR 095-128 R
82-
* 240 IRR 128-159 R
83-
* 250 IRR 160-191 R
84-
* 260 IRR 192-223 R
85-
* 270 IRR 224-255 R
86-
* 280 Error Status Register R
87-
* 290 Reserved
88-
* 2A0 Reserved
89-
* 2B0 Reserved
90-
* 2C0 Reserved
91-
* 2D0 Reserved
92-
* 2E0 Reserved
93-
* 2F0 Local Vector Table (CMCI) R/W
94-
* 300 ICR_LOW Interrupt Command Reg. (0-31) R/W
95-
* 310 ICR_HI Interrupt Command Reg. (32-63) R/W
96-
* 320 Local Vector Table (Timer) R/W
97-
* 330 Local Vector Table (Thermal) R/W (PIV+)
98-
* 340 Local Vector Table (Performance) R/W (P6+)
99-
* 350 LVT1 Local Vector Table (LINT0) R/W
100-
* 360 LVT2 Local Vector Table (LINT1) R/W
101-
* 370 LVT3 Local Vector Table (ERROR) R/W
102-
* 380 Initial Count Reg. for Timer R/W
103-
* 390 Current Count of Timer R
104-
* 3A0 Reserved
105-
* 3B0 Reserved
106-
* 3C0 Reserved
107-
* 3D0 Reserved
108-
* 3E0 Timer Divide Configuration Reg. R/W
109-
* 3F0 Reserved
110-
*/
111-
112-
11336
/******************************************************************************
11437
* global defines, etc.
11538
*/
@@ -123,33 +46,36 @@ struct lapic_reg {
12346
uint32_t pad[3];
12447
};
12548

126-
struct lapic_regs {
49+
struct lapic_regs { /*OFFSET(Hex)*/
12750
struct lapic_reg rsv0[2];
128-
struct lapic_reg id;
129-
struct lapic_reg version;
51+
struct lapic_reg id; /*020*/
52+
struct lapic_reg version; /*030*/
13053
struct lapic_reg rsv1[4];
131-
struct lapic_reg tpr;
132-
struct lapic_reg apr;
133-
struct lapic_reg ppr;
134-
struct lapic_reg eoi;
135-
struct lapic_reg rsv2;
136-
struct lapic_reg ldr;
137-
struct lapic_reg dfr;
138-
struct lapic_reg svr;
139-
struct lapic_reg isr[8];
140-
struct lapic_reg tmr[8];
141-
struct lapic_reg irr[8];
142-
struct lapic_reg esr;
143-
struct lapic_reg rsv3[6];
144-
struct lapic_reg lvt_cmci;
145-
struct lapic_reg icr_lo;
146-
struct lapic_reg icr_hi;
147-
struct lapic_reg lvt[6];
148-
struct lapic_reg icr_timer;
149-
struct lapic_reg ccr_timer;
150-
struct lapic_reg rsv4[4];
151-
struct lapic_reg dcr_timer;
152-
struct lapic_reg rsv5;
54+
struct lapic_reg tpr; /*080*/
55+
struct lapic_reg apr; /*090*/
56+
struct lapic_reg ppr; /*0A0*/
57+
struct lapic_reg eoi; /*0B0*/
58+
struct lapic_reg rrd; /*0C0*/
59+
struct lapic_reg ldr; /*0D0*/
60+
struct lapic_reg dfr; /*0EO*/
61+
struct lapic_reg svr; /*0F0*/
62+
struct lapic_reg isr[8]; /*100 -- 170*/
63+
struct lapic_reg tmr[8]; /*180 -- 1F0*/
64+
struct lapic_reg irr[8]; /*200 -- 270*/
65+
struct lapic_reg esr; /*280*/
66+
struct lapic_reg rsv2[6];
67+
struct lapic_reg lvt_cmci; /*2F0*/
68+
struct lapic_reg icr_lo; /*300*/
69+
struct lapic_reg icr_hi; /*310*/
70+
struct lapic_reg lvt[6]; /*320 -- 370*/
71+
struct lapic_reg icr_timer;/*380*/
72+
struct lapic_reg ccr_timer;/*390*/
73+
struct lapic_reg rsv3[4];
74+
struct lapic_reg dcr_timer;/*3E0*/
75+
struct lapic_reg rsv4;
76+
77+
/*roundup sizeof current struct to 4KB*/
78+
struct lapic_reg rsv5[192]; /*400 -- FF0*/
15379
} __aligned(CPU_PAGE_SIZE);
15480

15581
enum LAPIC_REGISTERS {

0 commit comments

Comments
 (0)