Jan Kiszka 3c507c26ec hw/i386/intel_iommu: Fix out-of-bounds access on guest IRT ...

vtd_irte_get failed to check the index against the configured table
size, causing an out-of-bounds access on guest memory and potentially
misinterpreting the result.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-Id: <4b15b728-bdfe-3bbe-3a5c-ca3baeef3c5c@siemens.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2020-03-16 23:02:22 +01:00

..

kvm

qdev: set properties with device_class_set_props()

2020-01-24 20:59:15 +01:00

xen

qdev: set properties with device_class_set_props()

2020-01-24 20:59:15 +01:00

acpi-build.c

hw/i386: Include "hw/mem/nvdimm.h"

2020-03-09 15:59:31 +01:00

acpi-build.h

…

amd_iommu.c

…

amd_iommu.h

…

e820_memory_layout.c

…

e820_memory_layout.h

…

fw_cfg.c

…

fw_cfg.h

…

intel_iommu_internal.h

…

intel_iommu.c

hw/i386/intel_iommu: Fix out-of-bounds access on guest IRT

2020-03-16 23:02:22 +01:00

Kconfig

tpm: Separate TPM_TIS and TPM_TIS_ISA configs

2020-03-05 12:18:00 -05:00

kvmvapic.c

…

Makefile.objs

…

microvm.c

x86/microvm: use memdev for RAM

2020-02-19 16:49:58 +00:00

multiboot.c

hw/core/loader: Let load_elf() populate a field with CPU-specific flags

2020-01-29 19:28:52 +01:00

multiboot.h

…

pc_piix.c

hw/i386: Include "hw/mem/nvdimm.h"

2020-03-09 15:59:31 +01:00

pc_q35.c

hw/i386: Include "hw/mem/nvdimm.h"

2020-03-09 15:59:31 +01:00

pc_sysfw.c

…

pc.c

hw/i386: Include "hw/mem/nvdimm.h"

2020-03-09 15:59:31 +01:00

port92.c

…

trace-events

…

vmmouse.c

hw/i386/vmmouse: Fix crash when using the vmmouse on a machine without vmport

2020-02-06 11:02:48 +01:00

vmport.c

…

x86-iommu-stub.c

…

x86-iommu.c

qdev: set properties with device_class_set_props()

2020-01-24 20:59:15 +01:00

x86.c

misc: Replace zero-length arrays with flexible array member (automatic)

2020-03-16 22:07:42 +01:00