60fd626
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
60fd626
From: Hans de Goede <hdegoede@redhat.com>
60fd626
Date: Tue, 19 May 2020 13:23:06 +0200
60fd626
Subject: [PATCH] virt: vbox: Fix guest capabilities mask check
60fd626
60fd626
Check the passed in capabilities against VMMDEV_GUEST_CAPABILITIES_MASK
60fd626
instead of against VMMDEV_EVENT_VALID_EVENT_MASK.
60fd626
This tightens the allowed mask from 0x7ff to 0x7.
60fd626
60fd626
Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration")
60fd626
Cc: stable@vger.kernel.org
60fd626
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
60fd626
Upstream Status: https://lore.kernel.org/lkml/20200520195440.38759-1-hdegoede@redhat.com/
60fd626
---
60fd626
 drivers/virt/vboxguest/vboxguest_core.c | 2 +-
60fd626
 drivers/virt/vboxguest/vmmdev.h         | 2 ++
60fd626
 2 files changed, 3 insertions(+), 1 deletion(-)
60fd626
60fd626
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
60fd626
index 8fab04e76c14..18ebd7a6af98 100644
60fd626
--- a/drivers/virt/vboxguest/vboxguest_core.c
60fd626
+++ b/drivers/virt/vboxguest/vboxguest_core.c
60fd626
@@ -1444,7 +1444,7 @@ static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
60fd626
 	or_mask = caps->u.in.or_mask;
60fd626
 	not_mask = caps->u.in.not_mask;
60fd626
60fd626
-	if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
60fd626
+	if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK)
60fd626
 		return -EINVAL;
60fd626
60fd626
 	ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
60fd626
diff --git a/drivers/virt/vboxguest/vmmdev.h b/drivers/virt/vboxguest/vmmdev.h
60fd626
index 6337b8d75d96..21f408120e3f 100644
60fd626
--- a/drivers/virt/vboxguest/vmmdev.h
60fd626
+++ b/drivers/virt/vboxguest/vmmdev.h
60fd626
@@ -206,6 +206,8 @@ VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8);
60fd626
  * not.
60fd626
  */
60fd626
 #define VMMDEV_GUEST_SUPPORTS_GRAPHICS                      BIT(2)
60fd626
+/* The mask of valid capabilities, for sanity checking. */
60fd626
+#define VMMDEV_GUEST_CAPABILITIES_MASK                      0x00000007U
60fd626
60fd626
 /** struct vmmdev_hypervisorinfo - Hypervisor info structure. */
60fd626
 struct vmmdev_hypervisorinfo {
60fd626
-- 
60fd626
2.26.2
60fd626