Eric Hankland <[email protected]> writes: > > +int kvm_vcpu_ioctl_set_pmu_whitelist(struct kvm_vcpu *vcpu, > + struct kvm_pmu_whitelist __user *whtlst) > +{ > + struct kvm_pmu *pmu = vcpu_to_pmu(vcpu); > + struct kvm_pmu_whitelist *old = pmu->whitelist; > + struct kvm_pmu_whitelist *new = NULL; > + struct kvm_pmu_whitelist tmp; > + int r; > + size_t size; > + > + r = -EFAULT; > + if (copy_from_user(&tmp, whtlst, sizeof(struct kvm_pmu_whitelist))) > + goto err; > + > + size = sizeof(tmp) + sizeof(tmp.events[0]) * tmp.num_events; > + new = kvzalloc(size, GFP_KERNEL_ACCOUNT);
Consider what happens when tmp.num_events is large enough to wrap size. I suspect that's a kernel exploit as written. Also don't you need to copy tmp to new? -Andi
