A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 11:54:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

vfio/platform: check the bounds of read/write syscalls

Browse source 
commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.

count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.

Fixes: 6e3f264560 (“vfio/platform: read and write support for the device fd”)
Cc: stable@vger.kernel.org
Reported-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alex Williamson 2025-01-22 10:38:30 -07:00 • committed by Greg Kroah-Hartman
commit 9377cdc118
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/vfio/platform/vfio_platform_common.c
View file

@ -410,6 +410,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg,
count = min_t(size_t, count, reg->size - off);
if (off >= reg->size)
return -EINVAL;
count = min_t(size_t, count, reg->size - off);
if (!reg->ioaddr) {
reg->ioaddr =
ioremap_nocache(reg->addr, reg->size);
@ -492,6 +497,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg,
count = min_t(size_t, count, reg->size - off);
if (off >= reg->size)
return -EINVAL;
count = min_t(size_t, count, reg->size - off);
if (!reg->ioaddr) {
reg->ioaddr =
ioremap_nocache(reg->addr, reg->size);