Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1363001

[PATCH 3.13.y-ckt 13/43] vfio: fix ioctl error handling

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.13.y-ckt 13/43] vfio: fix ioctl error handling
Date 2016-03-22 22:20 +0100
Message-ID <rfBSy-1PB-5@gated-at.bofh.it> (permalink)
References <rfBIR-1Lk-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt37 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Michael S. Tsirkin" <mst@redhat.com>

commit 8160c4e455820d5008a1116d2dca35f0363bb062 upstream.

Calling return copy_to_user(...) in an ioctl will not
do the right thing if there's a pagefault:
copy_to_user returns the number of bytes not copied
in this case.

Fix up vfio to do
	return copy_to_user(...)) ?
		-EFAULT : 0;

everywhere.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
[ luis: backported to 3.16:
  - dropped changes to vfio_platform_common.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/vfio/pci/vfio_pci.c     | 9 ++++++---
 drivers/vfio/vfio_iommu_type1.c | 6 ++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 275aa3fc..55fe2ee 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -357,7 +357,8 @@ static long vfio_pci_ioctl(void *device_data,
 		info.num_regions = VFIO_PCI_NUM_REGIONS;
 		info.num_irqs = VFIO_PCI_NUM_IRQS;
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		return copy_to_user((void __user *)arg, &info, minsz) ?
+			-EFAULT : 0;
 
 	} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
 		struct pci_dev *pdev = vdev->pdev;
@@ -430,7 +431,8 @@ static long vfio_pci_ioctl(void *device_data,
 			return -EINVAL;
 		}
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		return copy_to_user((void __user *)arg, &info, minsz) ?
+			-EFAULT : 0;
 
 	} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
 		struct vfio_irq_info info;
@@ -464,7 +466,8 @@ static long vfio_pci_ioctl(void *device_data,
 		else
 			info.flags |= VFIO_IRQ_INFO_NORESIZE;
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		return copy_to_user((void __user *)arg, &info, minsz) ?
+			-EFAULT : 0;
 
 	} else if (cmd == VFIO_DEVICE_SET_IRQS) {
 		struct vfio_irq_set hdr;
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 54af4e9..13d456a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -860,7 +860,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
 
 		info.iova_pgsizes = iommu->domain->ops->pgsize_bitmap;
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		return copy_to_user((void __user *)arg, &info, minsz) ?
+			-EFAULT : 0;
 
 	} else if (cmd == VFIO_IOMMU_MAP_DMA) {
 		struct vfio_iommu_type1_dma_map map;
@@ -893,7 +894,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
 		if (ret)
 			return ret;
 
-		return copy_to_user((void __user *)arg, &unmap, minsz);
+		return copy_to_user((void __user *)arg, &unmap, minsz) ?
+			-EFAULT : 0;
 	}
 
 	return -ENOTTY;
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt37 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 38/43] ext4: iterate over buffer heads correctly in move_extent_per_page() Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 39/43] net/mlx4_core: Allow resetting VF admin mac to zero Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 43/43] IB/core: Use GRH when the path hop-limit > 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 32/43] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 25/43] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 30/43] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 34/43] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:10 +0100
  [PATCH 3.13.y-ckt 18/43] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 13/43] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 20/43] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 23/43] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 16/43] ALSA: timer: Fix broken compat timer user status ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 05/43] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 22/43] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 24/43] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 08/43] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 02/43] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 07/43] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 17/43] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 11/43] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 01/43] [stable-only] AIO: properly check iovec sizes Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 14/43] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 04/43] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 06/43] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 10/43] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 15/43] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 27/43] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 09/43] jffs2: Fix page lock / f->sem deadlock Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 19/43] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100
  [PATCH 3.13.y-ckt 26/43] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-22 22:20 +0100

csiph-web