Paolo Bonzini 5678de3f15 KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155) ...

QE reported that they got the BUG_ON in ioapic_service to trigger.
I cannot reproduce it, but there are two reasons why this could happen.

The less likely but also easiest one, is when kvm_irq_delivery_to_apic
does not deliver to any APIC and returns -1.

Because irqe.shorthand == 0, the kvm_for_each_vcpu loop in that
function is never reached.  However, you can target the similar loop in
kvm_irq_delivery_to_apic_fast; just program a zero logical destination
address into the IOAPIC, or an out-of-range physical destination address.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2014-04-04 17:17:14 +02:00

..

arm

arm64: KVM: Add VGIC device control for arm64

2014-02-14 11:09:49 +01:00

assigned-dev.c

KVM: Move irq routing to generic code

2013-04-26 20:27:17 +02:00

async_pf.c

KVM: async_pf: Add missing call for async page present

2014-02-04 04:24:05 +01:00

async_pf.h

…

coalesced_mmio.c

KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio()

2014-01-30 11:56:09 +01:00

coalesced_mmio.h

KVM: Make coalesced mmio use a device per zone

2011-09-25 19:17:57 +03:00

eventfd.c

KVM: eventfd: Fix lock order inversion.

2014-03-18 17:06:04 +01:00

ioapic.c

KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)

2014-04-04 17:17:14 +02:00

ioapic.h

kvm: make local functions static

2014-01-08 19:02:58 -02:00

iodev.h

…

iommu.c

KVM: IOMMU: hva align mapping page size

2013-11-05 09:55:36 +02:00

irq_comm.c

KVM: Fix RTC interrupt coalescing tracking

2013-06-27 14:20:53 +03:00

irqchip.c

KVM: Move irq routing setup to irqchip.c

2013-04-26 20:27:18 +02:00

Kconfig

KVM: async_pf: Provide additional direct page notification

2014-01-30 12:51:38 +01:00

kvm_main.c

Merge tag 'kvm-3.15-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2014-04-02 14:50:10 -07:00

vfio.c

kvm: vfio: silence GCC warning

2014-01-15 12:01:48 +01:00