Bank_num is a one-based count of banks, not a zero-based index. It overflows the allocated space only when strictly greater than KVM_MAX_MCE_BANKS.
Unified · Split
| @@ -3759,7 +3759,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu, · 3758 unmodified lines | |||
| 3759 | unsigned bank_num = mcg_cap & 0xff, bank; | 3759 | unsigned bank_num = mcg_cap & 0xff, bank; |
| 3760 | 3760 | ||
| 3761 | r = -EINVAL; | 3761 | r = -EINVAL; |
| 3762 | if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) | 3762 | if (!bank_num || bank_num > KVM_MAX_MCE_BANKS) |
| 3763 | goto out; | 3763 | goto out; |
| 3764 | if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000)) | 3764 | if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000)) |
| 3765 | goto out; | 3765 | goto out; |