From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753476AbcAETr6 (ORCPT ); Tue, 5 Jan 2016 14:47:58 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:44941 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753152AbcAETrU (ORCPT ); Tue, 5 Jan 2016 14:47:20 -0500 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Joerg Roedel , Alex Williamson , Kamal Mostafa Subject: [PATCH 4.2.y-ckt 082/211] vfio: Fix bug in vfio_device_get_from_name() Date: Tue, 5 Jan 2016 11:43:10 -0800 Message-Id: <1452023119-25647-83-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1452023119-25647-1-git-send-email-kamal@canonical.com> References: <1452023119-25647-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 4.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.2.8-ckt1 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel commit e324fc82ea453fcbd3898ec7afb792f750c68979 upstream. The vfio_device_get_from_name() function might return a non-NULL pointer, when called with a device name that is not found in the list. This causes undefined behavior, in my case calling an invalid function pointer later on: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle kernel paging request at ffff8800cb3ddc08 [...] Call Trace: [] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio] [] do_vfs_ioctl+0x2cd/0x4c0 [] ? __fget+0x77/0xb0 [] SyS_ioctl+0x79/0x90 [] ? syscall_return_slowpath+0x50/0x130 [] entry_SYSCALL_64_fastpath+0x16/0x75 Fix the issue by returning NULL when there is no device with the requested name in the list. Fixes: 4bc94d5dc95d ("vfio: Fix lockdep issue") Signed-off-by: Joerg Roedel Signed-off-by: Alex Williamson Signed-off-by: Kamal Mostafa --- drivers/vfio/vfio.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 563c510..8c50ea6 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -692,11 +692,12 @@ EXPORT_SYMBOL_GPL(vfio_device_get_from_dev); static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group, char *buf) { - struct vfio_device *device; + struct vfio_device *it, *device = NULL; mutex_lock(&group->device_lock); - list_for_each_entry(device, &group->device_list, group_next) { - if (!strcmp(dev_name(device->dev), buf)) { + list_for_each_entry(it, &group->device_list, group_next) { + if (!strcmp(dev_name(it->dev), buf)) { + device = it; vfio_device_get(device); break; } -- 1.9.1