* [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap [not found] ` <20210412140238.184e141f@omen> @ 2021-04-12 21:41 ` Christian A. Ehrhardt 2021-04-13 0:24 ` David Gibson 2021-04-13 6:48 ` Cornelia Huck 0 siblings, 2 replies; 3+ messages in thread From: Christian A. Ehrhardt @ 2021-04-12 21:41 UTC (permalink / raw) To: kvm Cc: linux-kernel, Alex Williamson, Alexey Kardashevskiy, David Gibson, Michael Ellerman, Cornelia Huck When mmaping an extra device region verify that the region index derived from the mmap offset is valid. Fixes: a15b1883fee1 ("vfio_pci: Allow mapping extra regions") Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt <lk@c--e.de> --- drivers/vfio/pci/vfio_pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 65e7e6b44578..5023e23db3bc 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -1656,6 +1656,8 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT); + if (index >= VFIO_PCI_NUM_REGIONS + vdev->num_regions) + return -EINVAL; if (vma->vm_end < vma->vm_start) return -EINVAL; if ((vma->vm_flags & VM_SHARED) == 0) @@ -1664,7 +1666,7 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) int regnum = index - VFIO_PCI_NUM_REGIONS; struct vfio_pci_region *region = vdev->region + regnum; - if (region && region->ops && region->ops->mmap && + if (region->ops && region->ops->mmap && (region->flags & VFIO_REGION_INFO_FLAG_MMAP)) return region->ops->mmap(vdev, region, vma); return -EINVAL; -- 2.25.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap 2021-04-12 21:41 ` [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap Christian A. Ehrhardt @ 2021-04-13 0:24 ` David Gibson 2021-04-13 6:48 ` Cornelia Huck 1 sibling, 0 replies; 3+ messages in thread From: David Gibson @ 2021-04-13 0:24 UTC (permalink / raw) To: Christian A. Ehrhardt Cc: kvm, linux-kernel, Alex Williamson, Alexey Kardashevskiy, Michael Ellerman, Cornelia Huck [-- Attachment #1: Type: text/plain, Size: 1694 bytes --] On Mon, Apr 12, 2021 at 11:41:24PM +0200, Christian A. Ehrhardt wrote: > > When mmaping an extra device region verify that the region index > derived from the mmap offset is valid. > > Fixes: a15b1883fee1 ("vfio_pci: Allow mapping extra regions") > Cc: stable@vger.kernel.org > Signed-off-by: Christian A. Ehrhardt <lk@c--e.de> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> > --- > drivers/vfio/pci/vfio_pci.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c > index 65e7e6b44578..5023e23db3bc 100644 > --- a/drivers/vfio/pci/vfio_pci.c > +++ b/drivers/vfio/pci/vfio_pci.c > @@ -1656,6 +1656,8 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) > > index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT); > > + if (index >= VFIO_PCI_NUM_REGIONS + vdev->num_regions) > + return -EINVAL; > if (vma->vm_end < vma->vm_start) > return -EINVAL; > if ((vma->vm_flags & VM_SHARED) == 0) > @@ -1664,7 +1666,7 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) > int regnum = index - VFIO_PCI_NUM_REGIONS; > struct vfio_pci_region *region = vdev->region + regnum; > > - if (region && region->ops && region->ops->mmap && > + if (region->ops && region->ops->mmap && > (region->flags & VFIO_REGION_INFO_FLAG_MMAP)) > return region->ops->mmap(vdev, region, vma); > return -EINVAL; -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap 2021-04-12 21:41 ` [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap Christian A. Ehrhardt 2021-04-13 0:24 ` David Gibson @ 2021-04-13 6:48 ` Cornelia Huck 1 sibling, 0 replies; 3+ messages in thread From: Cornelia Huck @ 2021-04-13 6:48 UTC (permalink / raw) To: Christian A. Ehrhardt Cc: kvm, linux-kernel, Alex Williamson, Alexey Kardashevskiy, David Gibson, Michael Ellerman On Mon, 12 Apr 2021 23:41:24 +0200 "Christian A. Ehrhardt" <lk@c--e.de> wrote: > When mmaping an extra device region verify that the region index > derived from the mmap offset is valid. > > Fixes: a15b1883fee1 ("vfio_pci: Allow mapping extra regions") > Cc: stable@vger.kernel.org > Signed-off-by: Christian A. Ehrhardt <lk@c--e.de> > --- > drivers/vfio/pci/vfio_pci.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Reviewed-by: Cornelia Huck <cohuck@redhat.com> ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-13 6:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20210410230013.GC416417@lisa.in-ulm.de>
[not found] ` <20210412140238.184e141f@omen>
2021-04-12 21:41 ` [PATCH] vfio/pci: Add missing range check in vfio_pci_mmap Christian A. Ehrhardt
2021-04-13 0:24 ` David Gibson
2021-04-13 6:48 ` Cornelia Huck
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).