linux-imx/drivers/vfio
Vlad Tsyrklevich e4f13c5f27 vfio/pci: Fix integer overflows, bitmask check
commit 05692d7005 upstream.

The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize
user-supplied integers, potentially allowing memory corruption. This
patch adds appropriate integer overflow checks, checks the range bounds
for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element
in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set.
VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in
vfio_pci_set_irqs_ioctl().

Furthermore, a kzalloc is changed to a kcalloc because the use of a
kzalloc with an integer multiplication allowed an integer overflow
condition to be reached without this patch. kcalloc checks for overflow
and should prevent a similar occurrence.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
2017-01-27 17:14:54 +01:00
..
pci vfio/pci: Fix integer overflows, bitmask check 2017-01-27 17:14:54 +01:00
Kconfig powerpc/vfio: Enable on pSeries platform 2013-06-20 16:55:15 +10:00
Makefile powerpc/vfio: Implement IOMMU driver for VFIO 2013-06-20 16:55:14 +10:00
vfio_iommu_spapr_tce.c powerpc/vfio: Implement IOMMU driver for VFIO 2013-06-20 16:55:14 +10:00
vfio_iommu_type1.c mm: close PageTail race 2014-04-03 10:32:30 +02:00
vfio.c vfio: Add O_CLOEXEC flag to vfio device fd 2013-08-22 10:33:41 -06:00