diff options
| author | Christoffer Dall <christoffer.dall@linaro.org> | 2017-10-13 12:40:11 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-11-08 12:17:17 +0300 |
| commit | d5ccf4125420a4b1d36f2ff4f0554ae75827db16 (patch) | |
| tree | 4e5be0ee2900072b51b5a25b1a9db1e68ef5957a | |
| parent | eafa1e5b1dd5f09fd99aba2a5af00282fad6e089 (diff) | |
| download | linux-d5ccf4125420a4b1d36f2ff4f0554ae75827db16.tar.xz | |
KVM: arm64: its: Fix missing dynamic allocation check in scan_its_table
commit 8c1a8a32438b95792bbd8719d1cd4fe36e9eba03 upstream.
We currently allocate an entry dynamically, but we never check if the
allocation actually succeeded. We actually don't need a dynamic
allocation, because we know the maximum size of an ITS table entry, so
we can simply use an allocation on the stack.
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | virt/kvm/arm/vgic/vgic-its.c | 18 |
1 files changed, 7 insertions, 11 deletions
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index aa6b68db80b4..b606f1643fe5 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -1803,37 +1803,33 @@ typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry, static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz, int start_id, entry_fn_t fn, void *opaque) { - void *entry = kzalloc(esz, GFP_KERNEL); struct kvm *kvm = its->dev->kvm; unsigned long len = size; int id = start_id; gpa_t gpa = base; + char entry[esz]; int ret; + memset(entry, 0, esz); + while (len > 0) { int next_offset; size_t byte_offset; ret = kvm_read_guest(kvm, gpa, entry, esz); if (ret) - goto out; + return ret; next_offset = fn(its, id, entry, opaque); - if (next_offset <= 0) { - ret = next_offset; - goto out; - } + if (next_offset <= 0) + return next_offset; byte_offset = next_offset * esz; id += next_offset; gpa += byte_offset; len -= byte_offset; } - ret = 1; - -out: - kfree(entry); - return ret; + return 1; } /** |