Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'vfio-v4.9-rc4' of git://github.com/awilliam/linux-vfio
Pull VFIO fix from Alex Williamson:
"SET_IRQS ioctl parameter sanitization (Vlad Tsyrklevich)"
* tag 'vfio-v4.9-rc4' of git://github.com/awilliam/linux-vfio:
vfio/pci: Fix integer overflows, bitmask check
+22
-13
+21
-12
drivers/vfio/pci/vfio_pci.c
+21
-12
drivers/vfio/pci/vfio_pci.c
···
829
829
830
830
} else if (cmd == VFIO_DEVICE_SET_IRQS) {
831
831
struct vfio_irq_set hdr;
832
+
size_t size;
832
833
u8 *data = NULL;
833
-
int ret = 0;
834
+
int max, ret = 0;
834
835
835
836
minsz = offsetofend(struct vfio_irq_set, count);
836
837
···
839
838
return -EFAULT;
840
839
841
840
if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
841
+
hdr.count >= (U32_MAX - hdr.start) ||
842
842
hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
843
843
VFIO_IRQ_SET_ACTION_TYPE_MASK))
844
844
return -EINVAL;
845
845
846
-
if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
847
-
size_t size;
848
-
int max = vfio_pci_get_irq_count(vdev, hdr.index);
846
+
max = vfio_pci_get_irq_count(vdev, hdr.index);
847
+
if (hdr.start >= max || hdr.start + hdr.count > max)
848
+
return -EINVAL;
849
849
850
-
if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
851
-
size = sizeof(uint8_t);
852
-
else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
853
-
size = sizeof(int32_t);
854
-
else
855
-
return -EINVAL;
850
+
switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
851
+
case VFIO_IRQ_SET_DATA_NONE:
852
+
size = 0;
853
+
break;
854
+
case VFIO_IRQ_SET_DATA_BOOL:
855
+
size = sizeof(uint8_t);
856
+
break;
857
+
case VFIO_IRQ_SET_DATA_EVENTFD:
858
+
size = sizeof(int32_t);
859
+
break;
860
+
default:
861
+
return -EINVAL;
862
+
}
856
863
857
-
if (hdr.argsz - minsz < hdr.count * size ||
858
-
hdr.start >= max || hdr.start + hdr.count > max)
864
+
if (size) {
865
+
if (hdr.argsz - minsz < hdr.count * size)
859
866
return -EINVAL;
860
867
861
868
data = memdup_user((void __user *)(arg + minsz),
+1
-1
drivers/vfio/pci/vfio_pci_intrs.c
+1
-1
drivers/vfio/pci/vfio_pci_intrs.c