Skip to content

Commit 773e89a

Browse files
Zelin Dengbonzini
authored andcommitted
ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements; if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is 64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with "src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to be valid. Fixes: 95a3d44 ("Switch kvmclock data to a PER_CPU variable") Signed-off-by: Zelin Deng <[email protected]> Cc: <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
1 parent ad9af93 commit 773e89a

File tree

1 file changed

+2
-7
lines changed

1 file changed

+2
-7
lines changed

drivers/ptp/ptp_kvm_x86.c

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515
#include <linux/ptp_clock_kernel.h>
1616
#include <linux/ptp_kvm.h>
1717

18-
struct pvclock_vsyscall_time_info *hv_clock;
19-
2018
static phys_addr_t clock_pair_gpa;
2119
static struct kvm_clock_pairing clock_pair;
2220

@@ -28,8 +26,7 @@ int kvm_arch_ptp_init(void)
2826
return -ENODEV;
2927

3028
clock_pair_gpa = slow_virt_to_phys(&clock_pair);
31-
hv_clock = pvclock_get_pvti_cpu0_va();
32-
if (!hv_clock)
29+
if (!pvclock_get_pvti_cpu0_va())
3330
return -ENODEV;
3431

3532
ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa,
@@ -64,10 +61,8 @@ int kvm_arch_ptp_get_crosststamp(u64 *cycle, struct timespec64 *tspec,
6461
struct pvclock_vcpu_time_info *src;
6562
unsigned int version;
6663
long ret;
67-
int cpu;
6864

69-
cpu = smp_processor_id();
70-
src = &hv_clock[cpu].pvti;
65+
src = this_cpu_pvti();
7166

7267
do {
7368
/*

0 commit comments

Comments
 (0)