Re: [PATCH] vfio: Fix bug in vfio_device_get_from_name()

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From	Alex Williamson <alex.williamson@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] vfio: Fix bug in vfio_device_get_from_name()
Date	Wed, 04 Nov 2015 17:30:01 +0100
Message-ID	<qr96F-2O2-11@gated-at.bofh.it> (permalink)
References	<qr5Ps-yZ-25@gated-at.bofh.it>
X-Original-To	Joerg Roedel <joro@8bytes.org>
Content-Type	text/plain; charset="UTF-8"
MIME-Version	1.0
Content-Transfer-Encoding	7bit
X-Scanned-By	MIMEDefang 2.68 on 10.5.11.22
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	65
Organization	linux.* mail to news gateway
X-Original-Cc	kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Joerg Roedel <jroedel@suse.de>, stable@vger.kernel.org
X-Original-Date	Wed, 04 Nov 2015 09:28:48 -0700
X-Original-Message-ID	<1446654528.3692.101.camel@redhat.com>
X-Original-References	<1446641626-12458-1-git-send-email-joro@8bytes.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1262420

Show key headers only | View raw

On Wed, 2015-11-04 at 13:53 +0100, Joerg Roedel wrote:
> From: Joerg Roedel <jroedel@suse.de>
> 
> The vfio_device_get_from_name() function might return a
> non-NULL pointer, when called with a device name that is not
> found in the list. This causes undefined behavior, in my
> case calling an invalid function pointer later on:
> 
>  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
>  BUG: unable to handle kernel paging request at ffff8800cb3ddc08
> 
> [...]
> 
>  Call Trace:
>   [<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
>   [<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0
>   [<ffffffff811f9657>] ? __fget+0x77/0xb0
>   [<ffffffff811efeb9>] SyS_ioctl+0x79/0x90
>   [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
>   [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75
> 
> Fix the issue by returning NULL when there is no device with
> the requested name in the list.
> 
> Cc: stable@vger.kernel.org # v4.2+
> Fixes: 4bc94d5dc95d ("vfio: Fix lockdep issue")
> Signed-off-by: Joerg Roedel <jroedel@suse.de>
> ---

Thanks for tracking this down, Joerg!  Looks right, I'll queue it for
next.  Thanks,

Alex

>  drivers/vfio/vfio.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 563c510..8c50ea6 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -692,11 +692,12 @@ EXPORT_SYMBOL_GPL(vfio_device_get_from_dev);
>  static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group,
>  						     char *buf)
>  {
> -	struct vfio_device *device;
> +	struct vfio_device *it, *device = NULL;
>  
>  	mutex_lock(&group->device_lock);
> -	list_for_each_entry(device, &group->device_list, group_next) {
> -		if (!strcmp(dev_name(device->dev), buf)) {
> +	list_for_each_entry(it, &group->device_list, group_next) {
> +		if (!strcmp(dev_name(it->dev), buf)) {
> +			device = it;
>  			vfio_device_get(device);
>  			break;
>  		}



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] vfio: Fix bug in vfio_device_get_from_name() Joerg Roedel <joro@8bytes.org> - 2015-11-04 14:00 +0100
  Re: [PATCH] vfio: Fix bug in vfio_device_get_from_name() Alex Williamson <alex.williamson@redhat.com> - 2015-11-04 17:30 +0100

csiph-web