kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/vfio
History
Vlad Tsyrklevich 6593fe0cbd vfio/pci: Fix integer overflows, bitmask check 
commit 05692d7005 upstream.

The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize
user-supplied integers, potentially allowing memory corruption. This
patch adds appropriate integer overflow checks, checks the range bounds
for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element
in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set.
VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in
vfio_pci_set_irqs_ioctl().

Furthermore, a kzalloc is changed to a kcalloc because the use of a
kzalloc with an integer multiplication allowed an integer overflow
condition to be reached without this patch. kcalloc checks for overflow
and should prevent a similar occurrence.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-11-20 01:17:37 +00:00
..
pci vfio/pci: Fix integer overflows, bitmask check 2016-11-20 01:17:37 +00:00
Kconfig vfio: always select ANON_INODES 2014-03-27 11:58:58 -06:00
Makefile powerpc/vfio: Implement IOMMU driver for VFIO 2013-06-20 16:55:14 +10:00
vfio.c driver core: dev_set_drvdata can no longer fail 2014-05-27 13:40:51 -07:00
vfio_iommu_spapr_tce.c powerpc/iommu: Update constant names to reflect their hardcoded page size 2013-12-30 14:17:06 +11:00
vfio_iommu_type1.c vfio: fix ioctl error handling 2016-03-24 10:00:54 +00:00