kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/vfio/pci
History
Giovanni Cabiddu 15bfacdb85 vfio/qat: fix overflow check in qat_vf_resume_write() 
commit 9283b73925 upstream.

The unsigned variable `size_t len` is cast to the signed type `loff_t`
when passed to the function check_add_overflow(). This function considers
the type of the destination, which is of type loff_t (signed),
potentially leading to an overflow. This issue is similar to the one
described in the link below.

Remove the cast.

Note that even if check_add_overflow() is bypassed, by setting `len` to
a value that is greater than LONG_MAX (which is considered as a negative
value after the cast), the function copy_from_user(), invoked a few lines
later, will not perform any copy and return `len` as (len > INT_MAX)
causing qat_vf_resume_write() to fail with -EFAULT.

Fixes: bb208810b1 ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
CC: stable@vger.kernel.org # 6.10+
Link: https://lore.kernel.org/all/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
Reported-by: Zijie Zhao <zzjas98@gmail.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Xin Zeng <xin.zeng@intel.com>
Link: https://lore.kernel.org/r/20241021123843.42979-1-giovanni.cabiddu@intel.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-12-09 10:41:04 +01:00
..
hisilicon [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
mlx5 vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data() 2024-12-05 14:02:28 +01:00
nvgrace-gpu vfio/nvgrace-gpu: Convey kvm to map device memory region as noncached 2024-03-04 16:11:06 -07:00
pds [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
qat vfio/qat: fix overflow check in qat_vf_resume_write() 2024-12-09 10:41:04 +01:00
virtio vfio/pci: rename and export range_intersect_range 2024-02-22 12:20:20 -07:00
Kconfig vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices 2024-04-29 13:25:41 -06:00
Makefile vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices 2024-04-29 13:25:41 -06:00
trace.h vfio/pci: Cleanup license mess 2019-01-22 11:06:05 -07:00
vfio_pci.c VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist 2024-05-13 14:07:33 +00:00
vfio_pci_config.c vfio/pci: Properly hide first-in-list PCIe extended capability 2024-12-05 14:02:29 +01:00
vfio_pci_core.c VFIO updates for v6.12 2024-09-24 12:07:47 -07:00
vfio_pci_igd.c vfio: Use GFP_KERNEL_ACCOUNT for userspace persistent allocations 2023-01-23 11:26:29 -07:00
vfio_pci_intrs.c vfio/pci: fix potential memory leak in vfio_intx_enable() 2024-04-22 16:52:08 -06:00
vfio_pci_priv.h vfio/pci: Mask INTx during runtime suspend 2022-09-01 15:29:11 -06:00
vfio_pci_rdwr.c vfio/pci: Support 8-byte PCI loads and stores 2024-06-21 12:47:01 -06:00
vfio_pci_zdev.c Merge remote-tracking branch 'mlx5/mlx5-vfio' into v6.1/vfio/next 2022-09-08 10:44:34 -06:00