diff for duplicates of <1454362478.10542.8.camel@redhat.com> diff --git a/a/1.txt b/N1/1.txt index 7a67600..4da1299 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -8,86 +8,86 @@ On Mon, 2016-02-01 at 18:27 +0100, Eric Auger wrote: > > > becomes 0xffffffff, leading to the loop being entered again and things > > > turn bad when accessing vdev->msix[vector].vector. So let's use int > > > parameters instead. -> > > ? +> > > > > > Signed-off-by: Eric Auger <eric.auger@linaro.org> > > > --- -> > > ?drivers/vfio/pci/vfio_pci_intrs.c | 4 ++-- -> > > ?1 file changed, 2 insertions(+), 2 deletions(-) -> > > ? +> > > drivers/vfio/pci/vfio_pci_intrs.c | 4 ++-- +> > > 1 file changed, 2 insertions(+), 2 deletions(-) +> > > > > > diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c > > > index 3b3ba15..510c48d 100644 > > > --- a/drivers/vfio/pci/vfio_pci_intrs.c > > > +++ b/drivers/vfio/pci/vfio_pci_intrs.c > > > @@ -374,8 +374,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -> > > ? return 0; -> > > ?} -> > > ? +> > > return 0; +> > > } +> > > > > > -static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -> > > - ??????unsigned count, int32_t *fds, bool msix) +> > > - unsigned count, int32_t *fds, bool msix) > > > +static int vfio_msi_set_block(struct vfio_pci_device *vdev, int start, -> > > + ??????int count, int32_t *fds, bool msix) -> > > ?{ -> > > ? int i, j, ret = 0; -> > > ? -> >? -> > Nice find, I don't think that's the only bug there though.??If @start is +> > > + int count, int32_t *fds, bool msix) +> > > { +> > > int i, j, ret = 0; +> > > +> > +> > Nice find, I don't think that's the only bug there though. If @start is > > -1 (UINT32_MAX) and @count is 1, then @j gets set to -1 in the setup and -> > we hit the same index dereference problem.??What if we did this instead: -> >? +> > we hit the same index dereference problem. What if we did this instead: +> > > > diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c > > index 3b3ba15..2ae84ad 100644 > > --- a/drivers/vfio/pci/vfio_pci_intrs.c > > +++ b/drivers/vfio/pci/vfio_pci_intrs.c > > @@ -309,14 +309,14 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -> > ? ??????int vector, int fd, bool msix) -> > ?{ -> > ? struct pci_dev *pdev = vdev->pdev; +> > int vector, int fd, bool msix) +> > { +> > struct pci_dev *pdev = vdev->pdev; > > - int irq = msix ? vdev->msix[vector].vector : pdev->irq + vector; > > - char *name = msix ? "vfio-msix" : "vfio-msi"; -> > ? struct eventfd_ctx *trigger; +> > struct eventfd_ctx *trigger; > > - int ret; > > + int irq, ret; -> > ? +> > > > - if (vector >= vdev->num_ctx) > > + if (vector < 0 || vector >= vdev->num_ctx) -> > ? return -EINVAL; -> > ? +> > return -EINVAL; +> > > > + irq = msix ? vdev->msix[vector].vector : pdev->irq + vector; > > + -> > ? if (vdev->ctx[vector].trigger) { -> > ? free_irq(irq, vdev->ctx[vector].trigger); -> > ? irq_bypass_unregister_producer(&vdev->ctx[vector].producer); +> > if (vdev->ctx[vector].trigger) { +> > free_irq(irq, vdev->ctx[vector].trigger); +> > irq_bypass_unregister_producer(&vdev->ctx[vector].producer); > > @@ -328,8 +328,9 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, -> > ? if (fd < 0) -> > ? return 0; -> > ? +> > if (fd < 0) +> > return 0; +> > > > - vdev->ctx[vector].name = kasprintf(GFP_KERNEL, "%s[%d](%s)", -> > - ???name, vector, pci_name(pdev)); +> > - name, vector, pci_name(pdev)); > > + vdev->ctx[vector].name = kasprintf(GFP_KERNEL, "vfio-msi%s[%d](%s)", -> > + ???msix ? "x" : "", vector, -> > + ???pci_name(pdev)); -> > ? if (!vdev->ctx[vector].name) -> > ? return -ENOMEM; -> > ? +> > + msix ? "x" : "", vector, +> > + pci_name(pdev)); +> > if (!vdev->ctx[vector].name) +> > return -ENOMEM; +> > > > @@ -379,7 +380,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -> > ?{ -> > ? int i, j, ret = 0; -> > ? +> > { +> > int i, j, ret = 0; +> > > > - if (start + count > vdev->num_ctx) > > + if (start >= vdev->num_ctx || start + count > vdev->num_ctx) -> > ? return -EINVAL; -> > ? -> > ? for (i = 0, j = start; i < count && !ret; i++, j++) { +> > return -EINVAL; +> > +> > for (i = 0, j = start; i < count && !ret; i++, j++) { > > @@ -388,7 +389,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start, -> > ? } -> > ? -> > ? if (ret) { +> > } +> > +> > if (ret) { > > - for (--j; j >= start; j--) > > + for (--j; j >= 0 && j >= start; j--) -> > ? vfio_msi_set_vector_signal(vdev, j, -1, msix); -> > ? } -> > ? -> >? +> > vfio_msi_set_vector_signal(vdev, j, -1, msix); +> > } +> > +> > > > So we fix the problem with vfio_msi_set_vector_signal() dereferencing > > the array before it validates the index (even though it shouldn't be > > able to get there anymore), and then we do a better job of verifying @@ -95,11 +95,11 @@ On Mon, 2016-02-01 at 18:27 +0100, Eric Auger wrote: > > num_ctx itself is signed) and finally explicitly test the <0 case, which > > I suppose we could also do by casting start at that point (we know it's > > within the bounds of a signed integer given the previous tests). ->? +> > Yes it looks OK to me. ->? +> > I guess you submit? I will test it. -Yep, I'll post a real patch.??Thanks, +Yep, I'll post a real patch. Thanks, Alex diff --git a/a/content_digest b/N1/content_digest index 0b6a472..7123db9 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,10 +1,15 @@ "ref\01454078586-5431-1-git-send-email-eric.auger@linaro.org\0" "ref\01454103676.9301.3.camel@redhat.com\0" "ref\056AF9585.1000904@linaro.org\0" - "From\0alex.williamson@redhat.com (Alex Williamson)\0" - "Subject\0[PATCH] vfio: pci: fix oops in case of vfio_msi_set_vector_signal failure\0" + "From\0Alex Williamson <alex.williamson@redhat.com>\0" + "Subject\0Re: [PATCH] vfio: pci: fix oops in case of vfio_msi_set_vector_signal failure\0" "Date\0Mon, 01 Feb 2016 14:34:38 -0700\0" - "To\0linux-arm-kernel@lists.infradead.org\0" + "To\0Eric Auger <eric.auger@linaro.org>" + eric.auger@st.com + linux-arm-kernel@lists.infradead.org + " christoffer.dall@linaro.org\0" + "Cc\0patches@linaro.org" + " linux-kernel@vger.kernel.org\0" "\00:1\0" "b\0" "On Mon, 2016-02-01 at 18:27 +0100, Eric Auger wrote:\n" @@ -17,86 +22,86 @@ "> > > becomes 0xffffffff, leading to the loop being entered again and things\n" "> > > turn bad when accessing vdev->msix[vector].vector. So let's use int\n" "> > > parameters instead.\n" - "> > > ?\n" + "> > > \302\240\n" "> > > Signed-off-by: Eric Auger <eric.auger@linaro.org>\n" "> > > ---\n" - "> > > ?drivers/vfio/pci/vfio_pci_intrs.c | 4 ++--\n" - "> > > ?1 file changed, 2 insertions(+), 2 deletions(-)\n" - "> > > ?\n" + "> > > \302\240drivers/vfio/pci/vfio_pci_intrs.c | 4 ++--\n" + "> > > \302\2401 file changed, 2 insertions(+), 2 deletions(-)\n" + "> > > \302\240\n" "> > > diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > > index 3b3ba15..510c48d 100644\n" "> > > --- a/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > > +++ b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > > @@ -374,8 +374,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "> > > ?\treturn 0;\n" - "> > > ?}\n" - "> > > ?\n" + "> > > \302\240\treturn 0;\n" + "> > > \302\240}\n" + "> > > \302\240\n" "> > > -static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "> > > -\t\t\t??????unsigned count, int32_t *fds, bool msix)\n" + "> > > -\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240unsigned count, int32_t *fds, bool msix)\n" "> > > +static int vfio_msi_set_block(struct vfio_pci_device *vdev, int start,\n" - "> > > +\t\t\t??????int count, int32_t *fds, bool msix)\n" - "> > > ?{\n" - "> > > ?\tint i, j, ret = 0;\n" - "> > > ?\n" - "> >?\n" - "> > Nice find, I don't think that's the only bug there though.??If @start is\n" + "> > > +\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240int count, int32_t *fds, bool msix)\n" + "> > > \302\240{\n" + "> > > \302\240\tint i, j, ret = 0;\n" + "> > > \302\240\n" + "> >\302\240\n" + "> > Nice find, I don't think that's the only bug there though.\302\240\302\240If @start is\n" "> > -1 (UINT32_MAX) and @count is 1, then @j gets set to -1 in the setup and\n" - "> > we hit the same index dereference problem.??What if we did this instead:\n" - "> >?\n" + "> > we hit the same index dereference problem.\302\240\302\240What if we did this instead:\n" + "> >\302\240\n" "> > diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > index 3b3ba15..2ae84ad 100644\n" "> > --- a/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > +++ b/drivers/vfio/pci/vfio_pci_intrs.c\n" "> > @@ -309,14 +309,14 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "> > ?\t\t\t\t??????int vector, int fd, bool msix)\n" - "> > ?{\n" - "> > ?\tstruct pci_dev *pdev = vdev->pdev;\n" + "> > \302\240\t\t\t\t\302\240\302\240\302\240\302\240\302\240\302\240int vector, int fd, bool msix)\n" + "> > \302\240{\n" + "> > \302\240\tstruct pci_dev *pdev = vdev->pdev;\n" "> > -\tint irq = msix ? vdev->msix[vector].vector : pdev->irq + vector;\n" "> > -\tchar *name = msix ? \"vfio-msix\" : \"vfio-msi\";\n" - "> > ?\tstruct eventfd_ctx *trigger;\n" + "> > \302\240\tstruct eventfd_ctx *trigger;\n" "> > -\tint ret;\n" "> > +\tint irq, ret;\n" - "> > ?\n" + "> > \302\240\n" "> > -\tif (vector >= vdev->num_ctx)\n" "> > +\tif (vector < 0 || vector >= vdev->num_ctx)\n" - "> > ?\t\treturn -EINVAL;\n" - "> > ?\n" + "> > \302\240\t\treturn -EINVAL;\n" + "> > \302\240\n" "> > +\tirq = msix ? vdev->msix[vector].vector : pdev->irq + vector;\n" "> > +\n" - "> > ?\tif (vdev->ctx[vector].trigger) {\n" - "> > ?\t\tfree_irq(irq, vdev->ctx[vector].trigger);\n" - "> > ?\t\tirq_bypass_unregister_producer(&vdev->ctx[vector].producer);\n" + "> > \302\240\tif (vdev->ctx[vector].trigger) {\n" + "> > \302\240\t\tfree_irq(irq, vdev->ctx[vector].trigger);\n" + "> > \302\240\t\tirq_bypass_unregister_producer(&vdev->ctx[vector].producer);\n" "> > @@ -328,8 +328,9 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,\n" - "> > ?\tif (fd < 0)\n" - "> > ?\t\treturn 0;\n" - "> > ?\n" + "> > \302\240\tif (fd < 0)\n" + "> > \302\240\t\treturn 0;\n" + "> > \302\240\n" "> > -\tvdev->ctx[vector].name = kasprintf(GFP_KERNEL, \"%s[%d](%s)\",\n" - "> > -\t\t\t\t\t???name, vector, pci_name(pdev));\n" + "> > -\t\t\t\t\t\302\240\302\240\302\240name, vector, pci_name(pdev));\n" "> > +\tvdev->ctx[vector].name = kasprintf(GFP_KERNEL, \"vfio-msi%s[%d](%s)\",\n" - "> > +\t\t\t\t\t???msix ? \"x\" : \"\", vector,\n" - "> > +\t\t\t\t\t???pci_name(pdev));\n" - "> > ?\tif (!vdev->ctx[vector].name)\n" - "> > ?\t\treturn -ENOMEM;\n" - "> > ?\n" + "> > +\t\t\t\t\t\302\240\302\240\302\240msix ? \"x\" : \"\", vector,\n" + "> > +\t\t\t\t\t\302\240\302\240\302\240pci_name(pdev));\n" + "> > \302\240\tif (!vdev->ctx[vector].name)\n" + "> > \302\240\t\treturn -ENOMEM;\n" + "> > \302\240\n" "> > @@ -379,7 +380,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "> > ?{\n" - "> > ?\tint i, j, ret = 0;\n" - "> > ?\n" + "> > \302\240{\n" + "> > \302\240\tint i, j, ret = 0;\n" + "> > \302\240\n" "> > -\tif (start + count > vdev->num_ctx)\n" "> > +\tif (start >= vdev->num_ctx || start + count > vdev->num_ctx)\n" - "> > ?\t\treturn -EINVAL;\n" - "> > ?\n" - "> > ?\tfor (i = 0, j = start; i < count && !ret; i++, j++) {\n" + "> > \302\240\t\treturn -EINVAL;\n" + "> > \302\240\n" + "> > \302\240\tfor (i = 0, j = start; i < count && !ret; i++, j++) {\n" "> > @@ -388,7 +389,7 @@ static int vfio_msi_set_block(struct vfio_pci_device *vdev, unsigned start,\n" - "> > ?\t}\n" - "> > ?\n" - "> > ?\tif (ret) {\n" + "> > \302\240\t}\n" + "> > \302\240\n" + "> > \302\240\tif (ret) {\n" "> > -\t\tfor (--j; j >= start; j--)\n" "> > +\t\tfor (--j; j >= 0 && j >= start; j--)\n" - "> > ?\t\t\tvfio_msi_set_vector_signal(vdev, j, -1, msix);\n" - "> > ?\t}\n" - "> > ?\n" - "> >?\n" + "> > \302\240\t\t\tvfio_msi_set_vector_signal(vdev, j, -1, msix);\n" + "> > \302\240\t}\n" + "> > \302\240\n" + "> >\302\240\n" "> > So we fix the problem with vfio_msi_set_vector_signal() dereferencing\n" "> > the array before it validates the index (even though it shouldn't be\n" "> > able to get there anymore), and then we do a better job of verifying\n" @@ -104,13 +109,13 @@ "> > num_ctx itself is signed) and finally explicitly test the <0 case, which\n" "> > I suppose we could also do by casting start at that point (we know it's\n" "> > within the bounds of a signed integer given the previous tests).\n" - ">?\n" + ">\302\240\n" "> Yes it looks OK to me.\n" - ">?\n" + ">\302\240\n" "> I guess you submit? I will test it.\n" "\n" - "Yep, I'll post a real patch.??Thanks,\n" + "Yep, I'll post a real patch.\302\240\302\240Thanks,\n" "\n" Alex -52f741ab6d36221d92970962e71bd8fe526c3f1ad814f4637b9499490d90b2ed +3081e07390614353f1cee1e63e1665f1ddf9dc2fa37207bc371e3b7c83f4b617
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.