linux/drivers/vfio/pci
Alex Williamson c8952a7075 vfio/pci: Fix NULL pointer oops in error interrupt setup handling
There are multiple cases in vfio_pci_set_ctx_trigger_single() where
we assume we can safely read from our data pointer without actually
checking whether the user has passed any data via the count field.
VFIO_IRQ_SET_DATA_NONE in particular is entirely broken since we
attempt to pull an int32_t file descriptor out before even checking
the data type.  The other data types assume the data pointer contains
one element of their type as well.

In part this is good news because we were previously restricted from
doing much sanitization of parameters because it was missed in the
past and we didn't want to break existing users.  Clearly DATA_NONE
is completely broken, so it must not have any users and we can fix
it up completely.  For DATA_BOOL and DATA_EVENTFD, we'll just
protect ourselves, returning error when count is zero since we
previously would have oopsed.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Chris Thompson <the_cartographer@hotmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Auger <eric.auger@redhat.com>
2016-08-08 16:16:23 -06:00
..
Kconfig vfio/pci: Intel IGD OpRegion support 2016-02-22 16:10:09 -07:00
Makefile vfio/pci: Intel IGD OpRegion support 2016-02-22 16:10:09 -07:00
vfio_pci_config.c vfio/pci: Allow VPD short read 2016-05-31 21:25:52 -06:00
vfio_pci_igd.c vfio/pci: Intel IGD host and LCP bridge config space access 2016-02-22 16:10:09 -07:00
vfio_pci_intrs.c vfio/pci: Fix NULL pointer oops in error interrupt setup handling 2016-08-08 16:16:23 -06:00
vfio_pci_private.h vfio-pci: Allow to mmap sub-page MMIO BARs if the mmio page is exclusive 2016-07-08 10:06:04 -06:00
vfio_pci_rdwr.c vfio/pci: Expose shadow ROM as PCI option ROM 2016-02-22 16:10:09 -07:00
vfio_pci.c vfio-pci: Allow to mmap sub-page MMIO BARs if the mmio page is exclusive 2016-07-08 10:06:04 -06:00