From: Wenwen Wang <wang6495@umn.edu>
To: Wenwen Wang <wang6495@umn.edu>
Cc: Kangjie Lu <kjlu@umn.edu>,
Alex Williamson <alex.williamson@redhat.com>,
kvm@vger.kernel.org (open list:VFIO DRIVER),
linux-kernel@vger.kernel.org (open list)
Subject: [PATCH v2] drivers/vfio: Fix a redundant copy bug
Date: Mon, 8 Oct 2018 13:06:20 -0500 [thread overview]
Message-ID: <1539021980-2412-1-git-send-email-wang6495@umn.edu> (raw)
In vfio_spapr_iommu_eeh_ioctl(), if the ioctl command is VFIO_EEH_PE_OP,
the user-space buffer 'arg' is copied to the kernel object 'op' and the
'argsz' and 'flags' fields of 'op' are checked. If the check fails, an
error code EINVAL is returned. Otherwise, 'op.op' is further checked
through a switch statement to invoke related handlers. If 'op.op' is
VFIO_EEH_PE_INJECT_ERR, the whole user-space buffer 'arg' is copied again
to 'op' to obtain the err information. However, in the following execution
of this case, the fields of 'op', except the field 'err', are actually not
used. That is, the second copy has a redundant part. Therefore, for both
performance consideration, the redundant part of the second copy should be
removed.
This patch removes such a part in the second copy. It only copies from
'err.type' to 'err.mask', which is exactly required by the
VFIO_EEH_PE_INJECT_ERR op.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
drivers/vfio/vfio_spapr_eeh.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/vfio/vfio_spapr_eeh.c b/drivers/vfio/vfio_spapr_eeh.c
index 38edeb4..66634c6 100644
--- a/drivers/vfio/vfio_spapr_eeh.c
+++ b/drivers/vfio/vfio_spapr_eeh.c
@@ -37,6 +37,7 @@ long vfio_spapr_iommu_eeh_ioctl(struct iommu_group *group,
struct eeh_pe *pe;
struct vfio_eeh_pe_op op;
unsigned long minsz;
+ unsigned long start, end;
long ret = -EINVAL;
switch (cmd) {
@@ -86,10 +87,12 @@ long vfio_spapr_iommu_eeh_ioctl(struct iommu_group *group,
ret = eeh_pe_configure(pe);
break;
case VFIO_EEH_PE_INJECT_ERR:
- minsz = offsetofend(struct vfio_eeh_pe_op, err.mask);
- if (op.argsz < minsz)
+ start = offsetof(struct vfio_eeh_pe_op, err.type);
+ end = offsetofend(struct vfio_eeh_pe_op, err.mask);
+ if (op.argsz < end)
return -EINVAL;
- if (copy_from_user(&op, (void __user *)arg, minsz))
+ if (copy_from_user(&op.err, (char __user *)arg +
+ start, end - start))
return -EFAULT;
ret = eeh_pe_inject_err(pe, op.err.type, op.err.func,
--
2.7.4
next reply other threads:[~2018-10-08 18:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-08 18:06 Wenwen Wang [this message]
2018-10-08 18:47 ` [PATCH v2] drivers/vfio: Fix a redundant copy bug Alex Williamson
2018-10-17 14:20 ` Wenwen Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1539021980-2412-1-git-send-email-wang6495@umn.edu \
--to=wang6495@umn.edu \
--cc=alex.williamson@redhat.com \
--cc=kjlu@umn.edu \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).