kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/vfio
History
Raghavendra Rao Ananta 479af0d9c6 vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd() 
commit 2f03f21fe7 upstream.

For the cases where user includes a non-zero value in 'token_uuid_ptr'
field of 'struct vfio_device_bind_iommufd', the copy_struct_from_user()
in vfio_df_ioctl_bind_iommufd() fails with -E2BIG. For the 'minsz' passed,
copy_struct_from_user() expects the newly introduced field to be zero-ed,
which would be incorrect in this case.

Fix this by passing the actual size of the kernel struct. If working
with a newer userspace, copy_struct_from_user() would copy the
'token_uuid_ptr' field, and if working with an old userspace, it would
zero out this field, thus still retaining backward compatibility.

Fixes: 86624ba3b5 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
Cc: stable@vger.kernel.org
Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20251031170603.2260022-2-rananta@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-02 12:57:28 +01:00
..
cdx vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ 2025-08-27 12:14:13 -06:00
fsl-mc vfio/fsl-mc: Mark for removal 2025-08-27 09:23:00 -06:00
mdev drivers: core: remove device_link argument from class_compat_[create|remove]_link 2025-01-10 15:42:20 +01:00
pci vfio/pci: Use RCU for error/request triggers to avoid circular locking 2025-12-18 14:03:27 +01:00
platform vfio/platform: Mark reset drivers for removal 2025-09-19 14:36:38 -06:00
container.c VFIO updates for v6.3-rc1 2023-02-25 11:52:57 -08:00
debugfs.c vfio: Dump migration features under debugfs 2025-10-06 11:22:48 -06:00
device_cdev.c vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd() 2026-01-02 12:57:28 +01:00
group.c vfio: Fix unbalanced vfio_df_close call in no-iommu mode 2025-07-11 14:43:37 -06:00
iommufd.c vfio: Fix unbalanced vfio_df_close call in no-iommu mode 2025-07-11 14:43:37 -06:00
Kconfig vfio/migration: Add debugfs to live migration driver 2023-12-04 14:29:08 -07:00
Makefile vfio/migration: Add debugfs to live migration driver 2023-12-04 14:29:08 -07:00
vfio.h vfio: replace CONFIG_HAVE_KVM with IS_ENABLED(CONFIG_KVM) 2024-02-08 08:45:35 -05:00
vfio_iommu_spapr_tce.c vfio/spapr: Always clear TCEs before unsetting the window 2024-06-28 17:03:39 +10:00
vfio_iommu_type1.c vfio/type1: handle DMA map/unmap up to the addressable limit 2025-10-28 15:54:41 -06:00
vfio_main.c vfio: return -ENOTTY for unsupported device feature 2025-09-19 14:45:43 -06:00
virqfd.c assorted variants of irqfd setup: convert to CLASS(fd) 2024-11-03 01:28:07 -05:00