diff for duplicates of <1454103676.9301.3.camel@redhat.com> diff --git a/a/1.txt b/N1/1.txt index 3def2d3..95fb134 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -5,92 +5,92 @@ On Fri, 2016-01-29 at 14:43 +0000, Eric Auger wrote: > becomes 0xffffffff, leading to the loop being entered again and things > turn bad when accessing vdev->msix[vector].vector. So let's use int > parameters instead. ->? +> > Signed-off-by: Eric Auger <eric.auger@linaro.org> > --- -> ?drivers/vfio/pci/vfio_pci_intrs.c | 4 ++-- -> ?1 file changed, 2 insertions(+), 2 deletions(-) ->? +> drivers/vfio/pci/vfio_pci_intrs.c | 4 ++-- +> 1 file changed, 2 insertions(+), 2 deletions(-) +> > diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c > index 3b3ba15..510c48d 100644 > --- a/drivers/vfio/pci/vfio_pci_intrs.c > +++ b/drivers/vfio/pci/vfio_pci_intrs.c > @@ -374,8 +374,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -> ? return 0; -> ?} -> ? +> return 0; +> } +> > -static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -> - ??????unsigned count, int32_t *fds, bool msix) +> - unsigned count, int32_t *fds, bool msix) > +static int vfio_msi_set_block(struct vfio_pci_device *vdev, int start, -> + ??????int count, int32_t *fds, bool msix) -> ?{ -> ? int i, j, ret = 0; -> ? +> + int count, int32_t *fds, bool msix) +> { +> int i, j, ret = 0; +> -Nice find, I don't think that's the only bug there though.??If @start is +Nice find, I don't think that's the only bug there though. If @start is -1 (UINT32_MAX) and @count is 1, then @j gets set to -1 in the setup and -we hit the same index dereference problem.??What if we did this instead: +we hit the same index dereference problem. What if we did this instead: diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c index 3b3ba15..2ae84ad 100644 --- a/drivers/vfio/pci/vfio_pci_intrs.c +++ b/drivers/vfio/pci/vfio_pci_intrs.c @@ -309,14 +309,14 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -? ??????int vector, int fd, bool msix) -?{ -? struct pci_dev *pdev = vdev->pdev; + int vector, int fd, bool msix) + { + struct pci_dev *pdev = vdev->pdev; - int irq = msix ? vdev->msix[vector].vector : pdev->irq + vector; - char *name = msix ? "vfio-msix" : "vfio-msi"; -? struct eventfd_ctx *trigger; + struct eventfd_ctx *trigger; - int ret; + int irq, ret; -? + - if (vector >= vdev->num_ctx) + if (vector < 0 || vector >= vdev->num_ctx) -? return -EINVAL; -? + return -EINVAL; + + irq = msix ? vdev->msix[vector].vector : pdev->irq + vector; + -? if (vdev->ctx[vector].trigger) { -? free_irq(irq, vdev->ctx[vector].trigger); -? irq_bypass_unregister_producer(&vdev->ctx[vector].producer); + if (vdev->ctx[vector].trigger) { + free_irq(irq, vdev->ctx[vector].trigger); + irq_bypass_unregister_producer(&vdev->ctx[vector].producer); @@ -328,8 +328,9 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -? if (fd < 0) -? return 0; -? + if (fd < 0) + return 0; + - vdev->ctx[vector].name = kasprintf(GFP_KERNEL, "%s[%d](%s)", -- ???name, vector, pci_name(pdev)); +- name, vector, pci_name(pdev)); + vdev->ctx[vector].name = kasprintf(GFP_KERNEL, "vfio-msi%s[%d](%s)", -+ ???msix ? "x" : "", vector, -+ ???pci_name(pdev)); -? if (!vdev->ctx[vector].name) -? return -ENOMEM; -? ++ msix ? "x" : "", vector, ++ pci_name(pdev)); + if (!vdev->ctx[vector].name) + return -ENOMEM; + @@ -379,7 +380,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -?{ -? int i, j, ret = 0; -? + { + int i, j, ret = 0; + - if (start + count > vdev->num_ctx) + if (start >= vdev->num_ctx || start + count > vdev->num_ctx) -? return -EINVAL; -? -? for (i = 0, j = start; i < count && !ret; i++, j++) { + return -EINVAL; + + for (i = 0, j = start; i < count && !ret; i++, j++) { @@ -388,7 +389,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -? } -? -? if (ret) { + } + + if (ret) { - for (--j; j >= start; j--) + for (--j; j >= 0 && j >= start; j--) -? vfio_msi_set_vector_signal(vdev, j, -1, msix); -? } -? + vfio_msi_set_vector_signal(vdev, j, -1, msix); + } + So we fix the problem with vfio_msi_set_vector_signal() dereferencing the array before it validates the index (even though it shouldn't be able to get there anymore), and then we do a better job of verifying start and count (comparing to num_ctx will use unsigned even though num_ctx itself is signed) and finally explicitly test the <0 case, which -I suppose we could also do by casting start@that point (we know it's +I suppose we could also do by casting start at that point (we know it's within the bounds of a signed integer given the previous tests). Thanks, diff --git a/a/content_digest b/N1/content_digest index 306f836..30ae6e5 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,8 +1,13 @@ "ref\01454078586-5431-1-git-send-email-eric.auger@linaro.org\0" - "From\0alex.williamson@redhat.com (Alex Williamson)\0" - "Subject\0[PATCH] vfio: pci: fix oops in case of vfio_msi_set_vector_signal failure\0" + "From\0Alex Williamson <alex.williamson@redhat.com>\0" + "Subject\0Re: [PATCH] vfio: pci: fix oops in case of vfio_msi_set_vector_signal failure\0" "Date\0Fri, 29 Jan 2016 14:41:16 -0700\0" - "To\0linux-arm-kernel@lists.infradead.org\0" + "To\0Eric Auger <eric.auger@linaro.org>" + eric.auger@st.com + linux-arm-kernel@lists.infradead.org + " christoffer.dall@linaro.org\0" + "Cc\0patches@linaro.org" + " linux-kernel@vger.kernel.org\0" "\00:1\0" "b\0" "On Fri, 2016-01-29 at 14:43 +0000, Eric Auger wrote:\n" @@ -12,95 +17,95 @@ "> becomes 0xffffffff, leading to the loop being entered again and things\n" "> turn bad when accessing vdev->msix[vector].vector. So let's use int\n" "> parameters instead.\n" - ">?\n" + ">\302\240\n" "> Signed-off-by: Eric Auger <eric.auger@linaro.org>\n" "> ---\n" - "> ?drivers/vfio/pci/vfio_pci_intrs.c | 4 ++--\n" - "> ?1 file changed, 2 insertions(+), 2 deletions(-)\n" - ">?\n" + "> \302\240drivers/vfio/pci/vfio_pci_intrs.c | 4 ++--\n" + "> \302\2401 file changed, 2 insertions(+), 2 deletions(-)\n" + ">\302\240\n" "> diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> index 3b3ba15..510c48d 100644\n" "> --- a/drivers/vfio/pci/vfio_pci_intrs.c\n" "> +++ b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> @@ -374,8 +374,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "> ?\treturn 0;\n" - "> ?}\n" - "> ?\n" + "> \302\240\treturn 0;\n" + "> \302\240}\n" + "> \302\240\n" "> -static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "> -\t\t\t??????unsigned count, int32_t *fds, bool msix)\n" + "> -\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240unsigned count, int32_t *fds, bool msix)\n" "> +static int vfio_msi_set_block(struct vfio_pci_device *vdev, int start,\n" - "> +\t\t\t??????int count, int32_t *fds, bool msix)\n" - "> ?{\n" - "> ?\tint i, j, ret = 0;\n" - "> ?\n" + "> +\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240int count, int32_t *fds, bool msix)\n" + "> \302\240{\n" + "> \302\240\tint i, j, ret = 0;\n" + "> \302\240\n" "\n" - "Nice find, I don't think that's the only bug there though.??If @start is\n" + "Nice find, I don't think that's the only bug there though.\302\240\302\240If @start is\n" "-1 (UINT32_MAX) and @count is 1, then @j gets set to -1 in the setup and\n" - "we hit the same index dereference problem.??What if we did this instead:\n" + "we hit the same index dereference problem.\302\240\302\240What if we did this instead:\n" "\n" "diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c\n" "index 3b3ba15..2ae84ad 100644\n" "--- a/drivers/vfio/pci/vfio_pci_intrs.c\n" "+++ b/drivers/vfio/pci/vfio_pci_intrs.c\n" "@@ -309,14 +309,14 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "?\t\t\t\t??????int vector, int fd, bool msix)\n" - "?{\n" - "?\tstruct pci_dev *pdev = vdev->pdev;\n" + "\302\240\t\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240int vector, int fd, bool msix)\n" + "\302\240{\n" + "\302\240\tstruct pci_dev *pdev = vdev->pdev;\n" "-\tint irq = msix ? vdev->msix[vector].vector : pdev->irq + vector;\n" "-\tchar *name = msix ? \"vfio-msix\" : \"vfio-msi\";\n" - "?\tstruct eventfd_ctx *trigger;\n" + "\302\240\tstruct eventfd_ctx *trigger;\n" "-\tint ret;\n" "+\tint irq, ret;\n" - "?\n" + "\302\240\n" "-\tif (vector >= vdev->num_ctx)\n" "+\tif (vector < 0 || vector >= vdev->num_ctx)\n" - "?\t\treturn -EINVAL;\n" - "?\n" + "\302\240\t\treturn -EINVAL;\n" + "\302\240\n" "+\tirq = msix ? vdev->msix[vector].vector : pdev->irq + vector;\n" "+\n" - "?\tif (vdev->ctx[vector].trigger) {\n" - "?\t\tfree_irq(irq, vdev->ctx[vector].trigger);\n" - "?\t\tirq_bypass_unregister_producer(&vdev->ctx[vector].producer);\n" + "\302\240\tif (vdev->ctx[vector].trigger) {\n" + "\302\240\t\tfree_irq(irq, vdev->ctx[vector].trigger);\n" + "\302\240\t\tirq_bypass_unregister_producer(&vdev->ctx[vector].producer);\n" "@@ -328,8 +328,9 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "?\tif (fd < 0)\n" - "?\t\treturn 0;\n" - "?\n" + "\302\240\tif (fd < 0)\n" + "\302\240\t\treturn 0;\n" + "\302\240\n" "-\tvdev->ctx[vector].name = kasprintf(GFP_KERNEL, \"%s[%d](%s)\",\n" - "-\t\t\t\t\t???name, vector, pci_name(pdev));\n" + "-\t\t\t\t\t\302\240\302\240\302\240name, vector, pci_name(pdev));\n" "+\tvdev->ctx[vector].name = kasprintf(GFP_KERNEL, \"vfio-msi%s[%d](%s)\",\n" - "+\t\t\t\t\t???msix ? \"x\" : \"\", vector,\n" - "+\t\t\t\t\t???pci_name(pdev));\n" - "?\tif (!vdev->ctx[vector].name)\n" - "?\t\treturn -ENOMEM;\n" - "?\n" + "+\t\t\t\t\t\302\240\302\240\302\240msix ? \"x\" : \"\", vector,\n" + "+\t\t\t\t\t\302\240\302\240\302\240pci_name(pdev));\n" + "\302\240\tif (!vdev->ctx[vector].name)\n" + "\302\240\t\treturn -ENOMEM;\n" + "\302\240\n" "@@ -379,7 +380,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "?{\n" - "?\tint i, j, ret = 0;\n" - "?\n" + "\302\240{\n" + "\302\240\tint i, j, ret = 0;\n" + "\302\240\n" "-\tif (start + count > vdev->num_ctx)\n" "+\tif (start >= vdev->num_ctx || start + count > vdev->num_ctx)\n" - "?\t\treturn -EINVAL;\n" - "?\n" - "?\tfor (i = 0, j = start; i < count && !ret; i++, j++) {\n" + "\302\240\t\treturn -EINVAL;\n" + "\302\240\n" + "\302\240\tfor (i = 0, j = start; i < count && !ret; i++, j++) {\n" "@@ -388,7 +389,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "?\t}\n" - "?\n" - "?\tif (ret) {\n" + "\302\240\t}\n" + "\302\240\n" + "\302\240\tif (ret) {\n" "-\t\tfor (--j; j >= start; j--)\n" "+\t\tfor (--j; j >= 0 && j >= start; j--)\n" - "?\t\t\tvfio_msi_set_vector_signal(vdev, j, -1, msix);\n" - "?\t}\n" - "?\n" + "\302\240\t\t\tvfio_msi_set_vector_signal(vdev, j, -1, msix);\n" + "\302\240\t}\n" + "\302\240\n" "\n" "So we fix the problem with vfio_msi_set_vector_signal() dereferencing\n" "the array before it validates the index (even though it shouldn't be\n" "able to get there anymore), and then we do a better job of verifying\n" "start and count (comparing to num_ctx will use unsigned even though\n" "num_ctx itself is signed) and finally explicitly test the <0 case, which\n" - "I suppose we could also do by casting start@that point (we know it's\n" + "I suppose we could also do by casting start at that point (we know it's\n" "within the bounds of a signed integer given the previous tests).\n" "Thanks,\n" "\n" Alex -09a0da6194cdc98b45a902a1f23ccdd01289d2b45e691e84e1ff694bc18a10e7 +7f9bf1202fb87887babe9580910a6d1364eb1030b8c9d011c3d27887afa099be
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.