lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 156/346] vfio/pci: Fix NULL pointer oops in error interrupt setup handling
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alex Williamson <alex.williamson@redhat.com>

    commit c8952a707556e04374d7b2fdb3a079d63ddf6f2f upstream.

    There are multiple cases in vfio_pci_set_ctx_trigger_single() where
    we assume we can safely read from our data pointer without actually
    checking whether the user has passed any data via the count field.
    VFIO_IRQ_SET_DATA_NONE in particular is entirely broken since we
    attempt to pull an int32_t file descriptor out before even checking
    the data type. The other data types assume the data pointer contains
    one element of their type as well.

    In part this is good news because we were previously restricted from
    doing much sanitization of parameters because it was missed in the
    past and we didn't want to break existing users. Clearly DATA_NONE
    is completely broken, so it must not have any users and we can fix
    it up completely. For DATA_BOOL and DATA_EVENTFD, we'll just
    protect ourselves, returning error when count is zero since we
    previously would have oopsed.

    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
    Reported-by: Chris Thompson <the_cartographer@hotmail.com>
    Reviewed-by: Eric Auger <eric.auger@redhat.com>
    [bwh: Backported to 3.16:
    - Drop changes to vfio_pci_set_req_trigger()
    - Apply remaining changes in vfio_pci_set_err_trigger()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/vfio/pci/vfio_pci_intrs.c | 85 ++++++++++++++++++++++-----------------
    1 file changed, 49 insertions(+), 36 deletions(-)

    --- a/drivers/vfio/pci/vfio_pci_intrs.c
    +++ b/drivers/vfio/pci/vfio_pci_intrs.c
    @@ -752,41 +752,58 @@ static int vfio_pci_set_err_trigger(stru
    unsigned index, unsigned start,
    unsigned count, uint32_t flags, void *data)
    {
    - int32_t fd = *(int32_t *)data;
    -
    - if ((index != VFIO_PCI_ERR_IRQ_INDEX) ||
    - !(flags & VFIO_IRQ_SET_DATA_TYPE_MASK))
    + if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1)
    return -EINVAL;

    /* DATA_NONE/DATA_BOOL enables loopback testing */
    if (flags & VFIO_IRQ_SET_DATA_NONE) {
    - if (vdev->err_trigger)
    - eventfd_signal(vdev->err_trigger, 1);
    - return 0;
    + if (vdev->err_trigger) {
    + if (count) {
    + eventfd_signal(vdev->err_trigger, 1);
    + } else {
    + eventfd_ctx_put(vdev->err_trigger);
    + vdev->err_trigger = NULL;
    + }
    + return 0;
    + }
    } else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
    - uint8_t trigger = *(uint8_t *)data;
    + uint8_t trigger;
    +
    + if (!count)
    + return -EINVAL;
    +
    + trigger = *(uint8_t *)data;
    if (trigger && vdev->err_trigger)
    eventfd_signal(vdev->err_trigger, 1);
    - return 0;
    - }

    - /* Handle SET_DATA_EVENTFD */
    - if (fd == -1) {
    - if (vdev->err_trigger)
    - eventfd_ctx_put(vdev->err_trigger);
    - vdev->err_trigger = NULL;
    return 0;
    - } else if (fd >= 0) {
    - struct eventfd_ctx *efdctx;
    - efdctx = eventfd_ctx_fdget(fd);
    - if (IS_ERR(efdctx))
    - return PTR_ERR(efdctx);
    - if (vdev->err_trigger)
    - eventfd_ctx_put(vdev->err_trigger);
    - vdev->err_trigger = efdctx;
    + } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
    + int32_t fd;
    +
    + if (!count)
    + return -EINVAL;
    +
    + fd = *(int32_t *)data;
    + if (fd == -1) {
    + if (vdev->err_trigger)
    + eventfd_ctx_put(vdev->err_trigger);
    + vdev->err_trigger = NULL;
    + } else if (fd >= 0) {
    + struct eventfd_ctx *efdctx;
    +
    + efdctx = eventfd_ctx_fdget(fd);
    + if (IS_ERR(efdctx))
    + return PTR_ERR(efdctx);
    +
    + if (vdev->err_trigger)
    + eventfd_ctx_put(vdev->err_trigger);
    +
    + vdev->err_trigger = efdctx;
    + }
    return 0;
    - } else
    - return -EINVAL;
    + }
    +
    + return -EINVAL;
    }
    int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
    unsigned index, unsigned start, unsigned count,
    \
     
     \ /
      Last update: 2016-11-14 03:50    [W:4.273 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site