linux-stable/drivers/vfio
Alex Williamson c8952a7075 vfio/pci: Fix NULL pointer oops in error interrupt setup handling
There are multiple cases in vfio_pci_set_ctx_trigger_single() where
we assume we can safely read from our data pointer without actually
checking whether the user has passed any data via the count field.
VFIO_IRQ_SET_DATA_NONE in particular is entirely broken since we
attempt to pull an int32_t file descriptor out before even checking
the data type.  The other data types assume the data pointer contains
one element of their type as well.

In part this is good news because we were previously restricted from
doing much sanitization of parameters because it was missed in the
past and we didn't want to break existing users.  Clearly DATA_NONE
is completely broken, so it must not have any users and we can fix
it up completely.  For DATA_BOOL and DATA_EVENTFD, we'll just
protect ourselves, returning error when count is zero since we
previously would have oopsed.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Chris Thompson <the_cartographer@hotmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Auger <eric.auger@redhat.com>
2016-08-08 16:16:23 -06:00
..
pci vfio/pci: Fix NULL pointer oops in error interrupt setup handling 2016-08-08 16:16:23 -06:00
platform vfio: platform: check reset call return code during release 2016-07-19 10:54:45 -06:00
Kconfig vfio: Include No-IOMMU mode 2015-12-21 15:28:11 -07:00
Makefile vfio: Split virqfd into a separate module for vfio bus drivers 2015-03-17 08:33:38 -06:00
vfio.c vfio: fix possible use after free of vfio group 2016-07-14 14:28:16 -06:00
vfio_iommu_spapr_tce.c VFIO updates for v4.7-rc1 2016-05-25 09:47:26 -07:00
vfio_iommu_type1.c vfio/type1: Fix build warning 2016-05-30 07:58:10 -06:00
vfio_spapr_eeh.c drivers/vfio: Support EEH error injection 2015-05-12 20:33:35 +10:00
virqfd.c vfio: Split virqfd into a separate module for vfio bus drivers 2015-03-17 08:33:38 -06:00