mirror of
https://github.com/torvalds/linux.git
synced 2026-05-30 10:04:04 +02:00
Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports. The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.
Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device. This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range.
Fixes:
|
||
|---|---|---|
| .. | ||
| trace.h | ||
| vgic-debug.c | ||
| vgic-init.c | ||
| vgic-irqfd.c | ||
| vgic-its.c | ||
| vgic-kvm-device.c | ||
| vgic-mmio-v2.c | ||
| vgic-mmio-v3.c | ||
| vgic-mmio.c | ||
| vgic-mmio.h | ||
| vgic-v2.c | ||
| vgic-v3-nested.c | ||
| vgic-v3.c | ||
| vgic-v4.c | ||
| vgic-v5.c | ||
| vgic.c | ||
| vgic.h | ||