Re: [GIT PULL 3/8] KVM: s390: fix get_all_floating_irqs

[Christian Borntraeger <borntraeger@de.ibm.com>]

Am 31.03.2015 um 16:12 schrieb Heiko Carstens:
> On Tue, Mar 31, 2015 at 03:01:58PM +0200, Christian Borntraeger wrote:
>> From: Jens Freimann <jfrei@linux.vnet.ibm.com>
>>
>> This fixes a bug introduced with commit c05c4186bbe4 ("KVM: s390:
>> add floating irq controller").
>>
>> get_all_floating_irqs() does copy_to_user() while holding
>> a spin lock. Let's fix this by filling a temporary buffer
>> first and copy it to userspace after giving up the lock.
>>
>> Cc: <stable@vger.kernel.org> # 3.18+: 69a8d4562638 KVM: s390: no need to hold...
>>
>> Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
>> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
>> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
>> Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
> 
> ...
> 
>> -static int get_all_floating_irqs(struct kvm *kvm, __u8 *buf, __u64 len)
>> +static int get_all_floating_irqs(struct kvm *kvm, __user u8 *usrbuf, u64 len)
> 
> fwiw, this is probably the only place within the kernel where we see
> "__user u8 *" instead of "u8 __user *". This is odd within this whole
> patch.
> 
>> +		if (copy_to_user((void __user *) usrbuf,
> 
> The cast shouldn't be necessary at all...
> 

Yes, will fixup.


Paolo, Marcelo,

I will resend the pull request. But do not hesitate to review the other
patches :-)

Christian