[PATCH 2/3] KVM: x86: Fix off-by-one in max_vcpu_ids bounds checks

[Dmytro Maluka]

max_vcpu_ids and KVM_CAP_MAX_VCPU_ID are exclusive, i.e. the maximum
allowed vcpu_id value is max_vcpu_ids minus one, not max_vcpu_ids.

Fix sanity checks for KVM_SET_BOOT_CPU_ID and KVM_CAP_MAX_VCPU_ID to
fail when bsp_vcpu_id is incorrectly set to max_vcpu_ids, not to a value
below max_vcpu_ids.

Fixes: 7c305d5118e6 ("KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID")
Fixes: d29bf2ca1404 ("KVM: x86: Prevent excluding the BSP on setting 
max_vcpu_ids")
Signed-off-by: Dmytro Maluka <dmal...@chromium.org>
---
 arch/x86/kvm/x86.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 47cb9eba113b..b576b46869d2 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6908,7 +6908,7 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
                        break;
 
                mutex_lock(&kvm->lock);
-               if (kvm->arch.bsp_vcpu_id > cap->args[0]) {
+               if (kvm->arch.bsp_vcpu_id >= cap->args[0]) {
                        ;
                } else if (kvm->arch.max_vcpu_ids == cap->args[0]) {
                        r = 0;
@@ -7478,8 +7478,8 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int 
ioctl, unsigned long arg)
                mutex_lock(&kvm->lock);
                if (kvm->created_vcpus)
                        r = -EBUSY;
-               else if (arg > KVM_MAX_VCPU_IDS ||
-                        (kvm->arch.max_vcpu_ids && arg > 
kvm->arch.max_vcpu_ids))
+               else if (arg >= KVM_MAX_VCPU_IDS ||
+                        (kvm->arch.max_vcpu_ids && arg >= 
kvm->arch.max_vcpu_ids))
                        r = -EINVAL;
                else
                        kvm->arch.bsp_vcpu_id = arg;
-- 
2.55.0.508.g3f0d502094-goog