Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'vfio-v5.7-rc4' of git://github.com/awilliam/linux-vfio
Pull VFIO fixes from Alex Williamson:
- copy_*_user validity check for new vfio_dma_rw interface (Yan Zhao)
- Fix a potential math overflow (Yan Zhao)
- Use follow_pfn() for calculating PFNMAPs (Sean Christopherson)
* tag 'vfio-v5.7-rc4' of git://github.com/awilliam/linux-vfio:
vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()
vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
vfio: checking of validity of user vaddr in vfio_dma_rw
+5
-5
+5
-5
drivers/vfio/vfio_iommu_type1.c
+5
-5
drivers/vfio/vfio_iommu_type1.c
···
342
342
vma = find_vma_intersection(mm, vaddr, vaddr + 1);
343
343
344
344
if (vma && vma->vm_flags & VM_PFNMAP) {
345
-
*pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
346
-
if (is_invalid_reserved_pfn(*pfn))
345
+
if (!follow_pfn(vma, vaddr, pfn) &&
346
+
is_invalid_reserved_pfn(*pfn))
347
347
ret = 0;
348
348
}
349
349
done:
···
555
555
continue;
556
556
}
557
557
558
-
remote_vaddr = dma->vaddr + iova - dma->iova;
558
+
remote_vaddr = dma->vaddr + (iova - dma->iova);
559
559
ret = vfio_pin_page_external(dma, remote_vaddr, &phys_pfn[i],
560
560
do_accounting);
561
561
if (ret)
···
2345
2345
vaddr = dma->vaddr + offset;
2346
2346
2347
2347
if (write)
2348
-
*copied = __copy_to_user((void __user *)vaddr, data,
2348
+
*copied = copy_to_user((void __user *)vaddr, data,
2349
2349
count) ? 0 : count;
2350
2350
else
2351
-
*copied = __copy_from_user(data, (void __user *)vaddr,
2351
+
*copied = copy_from_user(data, (void __user *)vaddr,
2352
2352
count) ? 0 : count;
2353
2353
if (kthread)
2354
2354
unuse_mm(mm);