kvm: nVMX: off by one in vmx_write_pml_buffer()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 10 May 2017 19:43:17 +0000 (22:43 +0300)
committerRadim Krčmář <rkrcmar@redhat.com>
Mon, 15 May 2017 14:08:56 +0000 (16:08 +0200)
There are PML_ENTITY_NUM elements in the pml_address[] array so the >
should be >= or we write beyond the end of the array when we do:

pml_address[vmcs12->guest_pml_index--] = gpa;

Fixes: c5f983f6e845 ("nVMX: Implement emulated Page Modification Logging")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
arch/x86/kvm/vmx.c

index c6f4ad4..7698e8f 100644 (file)
@@ -11213,7 +11213,7 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
                if (!nested_cpu_has_pml(vmcs12))
                        return 0;
 
-               if (vmcs12->guest_pml_index > PML_ENTITY_NUM) {
+               if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
                        vmx->nested.pml_full = true;
                        return 1;
                }