From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yan Zhao <yan.y.zhao@intel.com>,
Alex Williamson <alex.williamson@redhat.com>,
Sasha Levin <sashal@kernel.org>,
kvm@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 04/35] vfio: avoid possible overflow in vfio_iommu_type1_pin_pages
Date: Thu, 7 May 2020 10:27:58 -0400 [thread overview]
Message-ID: <20200507142830.26239-4-sashal@kernel.org> (raw)
In-Reply-To: <20200507142830.26239-1-sashal@kernel.org>
From: Yan Zhao <yan.y.zhao@intel.com>
[ Upstream commit 0ea971f8dcd6dee78a9a30ea70227cf305f11ff7 ]
add parentheses to avoid possible vaddr overflow.
Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices")
Signed-off-by: Yan Zhao <yan.y.zhao@intel.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/vfio_iommu_type1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index d864277ea16f3..f471600985ff7 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -593,7 +593,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
continue;
}
- remote_vaddr = dma->vaddr + iova - dma->iova;
+ remote_vaddr = dma->vaddr + (iova - dma->iova);
ret = vfio_pin_page_external(dma, remote_vaddr, &phys_pfn[i],
do_accounting);
if (ret)
--
2.20.1
next prev parent reply other threads:[~2020-05-07 14:35 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 14:27 [PATCH AUTOSEL 5.4 01/35] RDMA/mlx4: Initialize ib_spec on the stack Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 02/35] RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr() Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 03/35] nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl Sasha Levin
2020-05-07 14:27 ` Sasha Levin [this message]
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 05/35] riscv: fix vdso build with lld Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 06/35] scsi: qla2xxx: set UNLOADING before waiting for session deletion Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 07/35] scsi: qla2xxx: check UNLOADING before posting async work Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 08/35] scsi: target/iblock: fix WRITE SAME zeroing Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 09/35] RDMA/mlx5: Set GRH fields in query QP on RoCE Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 10/35] RDMA/core: Prevent mixed use of FDs between shared ufiles Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 11/35] dmaengine: pch_dma.c: Avoid data race between probe and irq handler Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 12/35] dmaengine: mmp_tdma: Do not ignore slave config validation errors Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 13/35] dmaengine: mmp_tdma: Reset channel error on release Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 14/35] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 15/35] ALSA: hda: Match both PCI ID and SSID for driver blacklist Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 16/35] selftests/ftrace: Check the first record for kprobe_args_type.tc Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 17/35] RDMA/core: Fix race between destroy and release FD object Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 18/35] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 19/35] dma-buf: Fix SET_NAME ioctl uapi Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 20/35] nvme: prevent double free in nvme_alloc_ns() error handling Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 21/35] dmaengine: dmatest: Fix iteration non-stop logic Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 22/35] i2c: iproc: generate stop event for slave writes Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 23/35] ALSA: hda/hdmi: fix race in monitor detection during probe Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 24/35] dmaengine: dmatest: Fix process hang when reading 'wait' parameter Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 25/35] drm/amd/powerplay: avoid using pm_en before it is initialized revised Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 26/35] SUNRPC: defer slow parts of rpc_free_client() to a workqueue Sasha Levin
2020-05-07 21:18 ` NeilBrown
2020-05-16 23:10 ` Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 27/35] drm/amd/display: check if REFCLK_CNTL register is present Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 28/35] drm/amd/display: Update downspread percent to match spreadsheet for DCN2.1 Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 29/35] Fix use after free in get_tree_bdev() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 30/35] drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 31/35] ALSA: opti9xx: shut up gcc-10 range warning Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 32/35] i2c: aspeed: Avoid i2c interrupt status clear race condition Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 33/35] arm64: vdso: Add -fasynchronous-unwind-tables to cflags Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 34/35] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 35/35] iommu/qcom: Fix local_base status check Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200507142830.26239-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=alex.williamson@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yan.y.zhao@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).