]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
KVM: arm64: its: Fix missing dynamic allocation check in scan_its_table
authorChristoffer Dall <christoffer.dall@linaro.org>
Fri, 13 Oct 2017 09:40:11 +0000 (11:40 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Nov 2017 09:17:17 +0000 (10:17 +0100)
commit 8c1a8a32438b95792bbd8719d1cd4fe36e9eba03 upstream.

We currently allocate an entry dynamically, but we never check if the
allocation actually succeeded.  We actually don't need a dynamic
allocation, because we know the maximum size of an ITS table entry, so
we can simply use an allocation on the stack.

Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
virt/kvm/arm/vgic/vgic-its.c

index aa6b68db80b47c6089ef27c64dbf1e2654acc458..b606f1643fe5da1f0f9d2f81b5eb6cdcad828693 100644 (file)
@@ -1803,37 +1803,33 @@ typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry,
 static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz,
                          int start_id, entry_fn_t fn, void *opaque)
 {
-       void *entry = kzalloc(esz, GFP_KERNEL);
        struct kvm *kvm = its->dev->kvm;
        unsigned long len = size;
        int id = start_id;
        gpa_t gpa = base;
+       char entry[esz];
        int ret;
 
+       memset(entry, 0, esz);
+
        while (len > 0) {
                int next_offset;
                size_t byte_offset;
 
                ret = kvm_read_guest(kvm, gpa, entry, esz);
                if (ret)
-                       goto out;
+                       return ret;
 
                next_offset = fn(its, id, entry, opaque);
-               if (next_offset <= 0) {
-                       ret = next_offset;
-                       goto out;
-               }
+               if (next_offset <= 0)
+                       return next_offset;
 
                byte_offset = next_offset * esz;
                id += next_offset;
                gpa += byte_offset;
                len -= byte_offset;
        }
-       ret =  1;
-
-out:
-       kfree(entry);
-       return ret;
+       return 1;
 }
 
 /**