lkml.org 
[lkml]   [2015]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] vfio: Fix bug in vfio_device_get_from_name()
From
Date
On Wed, 2015-11-04 at 13:53 +0100, Joerg Roedel wrote:
> From: Joerg Roedel <jroedel@suse.de>
>
> The vfio_device_get_from_name() function might return a
> non-NULL pointer, when called with a device name that is not
> found in the list. This causes undefined behavior, in my
> case calling an invalid function pointer later on:
>
> kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
> BUG: unable to handle kernel paging request at ffff8800cb3ddc08
>
> [...]
>
> Call Trace:
> [<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
> [<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0
> [<ffffffff811f9657>] ? __fget+0x77/0xb0
> [<ffffffff811efeb9>] SyS_ioctl+0x79/0x90
> [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
> [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75
>
> Fix the issue by returning NULL when there is no device with
> the requested name in the list.
>
> Cc: stable@vger.kernel.org # v4.2+
> Fixes: 4bc94d5dc95d ("vfio: Fix lockdep issue")
> Signed-off-by: Joerg Roedel <jroedel@suse.de>
> ---

Thanks for tracking this down, Joerg! Looks right, I'll queue it for
next. Thanks,

Alex

> drivers/vfio/vfio.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 563c510..8c50ea6 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -692,11 +692,12 @@ EXPORT_SYMBOL_GPL(vfio_device_get_from_dev);
> static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group,
> char *buf)
> {
> - struct vfio_device *device;
> + struct vfio_device *it, *device = NULL;
>
> mutex_lock(&group->device_lock);
> - list_for_each_entry(device, &group->device_list, group_next) {
> - if (!strcmp(dev_name(device->dev), buf)) {
> + list_for_each_entry(it, &group->device_list, group_next) {
> + if (!strcmp(dev_name(it->dev), buf)) {
> + device = it;
> vfio_device_get(device);
> break;
> }





\
 
 \ /
  Last update: 2015-11-04 17:41    [W:0.140 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site