From 15da55057105d318f98ab4c3723d49e295226ff7 Mon Sep 17 00:00:00 2001 From: Manuel Andreas Date: Wed, 23 Jul 2025 17:51:20 +0200 Subject: [PATCH] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls mainline inclusion from mainline-v6.16-rc7 commit 5a53249d149f48b558368c5338b9921b76a12f8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD7K CVE: CVE-2025-38469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a53249d149f48b558368c5338b9921b76a12f8c -------------------------------- kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not. Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly") Reviewed-by: David Woodhouse Signed-off-by: Manuel Andreas [Adjusted commit message. - Paolo] Signed-off-by: Paolo Bonzini Signed-off-by: cuiyudong --- arch/x86/kvm/xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 0ea6016ad132..eb62e05e8e63 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1260,7 +1260,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, sched_poll.nr_ports * sizeof(*ports), &e)) { *r = -EFAULT; - return true; + goto out; } for (i = 0; i < sched_poll.nr_ports; i++) { -- Gitee