Alex Williamson 03844b1908 vfio/platform: check the bounds of read/write syscalls ...

commit ce9ff21ea8 upstream.

count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.

Fixes: 6e3f264560 (“vfio/platform: read and write support for the device fd”)
Cc: stable@vger.kernel.org
Reported-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-17 09:40:37 +01:00

..

cdx

…

fsl-mc

…

mdev

…

pci

…

platform

vfio/platform: check the bounds of read/write syscalls

2025-02-17 09:40:37 +01:00

container.c

…

device_cdev.c

…

group.c

…

iommufd.c

…

iova_bitmap.c

iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

2025-02-08 09:52:22 +01:00

Kconfig

…

Makefile

…

vfio_iommu_spapr_tce.c

…

vfio_iommu_type1.c

…

vfio_main.c

…

vfio.h

…

virqfd.c

…