leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vfio: Fix bug in vfio_device_get_from_name()

Browse Source 
The vfio_device_get_from_name() function might return a
non-NULL pointer, when called with a device name that is not
found in the list. This causes undefined behavior, in my
case calling an invalid function pointer later on:

 kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
 BUG: unable to handle kernel paging request at ffff8800cb3ddc08

[...]

 Call Trace:
  [<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
  [<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0
  [<ffffffff811f9657>] ? __fget+0x77/0xb0
  [<ffffffff811efeb9>] SyS_ioctl+0x79/0x90
  [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
  [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75

Fix the issue by returning NULL when there is no device with
the requested name in the list.

Cc: stable@vger.kernel.org # v4.2+
Fixes: 4bc94d5dc9 ("vfio: Fix lockdep issue")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
This commit is contained in:
Joerg Roedel 2015-11-04 13:53:26 +01:00 committed by Alex Williamson
parent 0990822c98
commit e324fc82ea
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/vfio/vfio.c
View File

@ -711,11 +711,12 @@ EXPORT_SYMBOL_GPL(vfio_device_get_from_dev);
static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group, static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group,
char *buf) char *buf)
{ {
struct vfio_device *device; struct vfio_device *it, *device = NULL;
mutex_lock(&group->device_lock); mutex_lock(&group->device_lock);
list_for_each_entry(device, &group->device_list, group_next) { list_for_each_entry(it, &group->device_list, group_next) {
if (!strcmp(dev_name(device->dev), buf)) { if (!strcmp(dev_name(it->dev), buf)) {
device = it;
vfio_device_get(device); vfio_device_get(device);
break; break;
} }