diff options
| author | Radim Krčmář <radim.krcmar@oss.qualcomm.com> | 2026-02-27 13:46:16 +0000 |
|---|---|---|
| committer | Anup Patel <anup@brainfault.org> | 2026-03-06 11:20:30 +0530 |
| commit | 5c1bb07871119eae6434c640e5e645a74d54a222 (patch) | |
| tree | bba8cb146225175caa4bdfea9dcf53445a0ea1b9 /arch | |
| parent | c28eb189e481f5dac993d1907710716a9b561890 (diff) | |
| download | lwn-5c1bb07871119eae6434c640e5e645a74d54a222.tar.gz lwn-5c1bb07871119eae6434c640e5e645a74d54a222.zip | |
RISC-V: KVM: fix off-by-one array access in SBI PMU
The indexed array only has RISCV_KVM_MAX_COUNTERS elements.
The out-of-bound access could have been performed by a guest,
but it could only access another guest accessible data.
Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf")
Signed-off-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260227134617.23378-1-radim.krcmar@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/riscv/kvm/vcpu_pmu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index 4d8d5e9aa53d..aec6b293968b 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -520,7 +520,7 @@ int kvm_riscv_vcpu_pmu_ctr_info(struct kvm_vcpu *vcpu, unsigned long cidx, { struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu); - if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) { + if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) { retdata->err_val = SBI_ERR_INVALID_PARAM; return 0; } |