* [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups()
@ 2024-09-12 8:49 Dan Carpenter
2024-09-12 13:11 ` Jason Gunthorpe
2024-09-12 20:48 ` Alex Williamson
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2024-09-12 8:49 UTC (permalink / raw)
To: Alex Williamson
Cc: Jason Gunthorpe, Kevin Tian, Yi Liu, Christian Brauner,
Kunwu Chan, Ankit Agrawal, kvm, linux-kernel, kernel-janitors
The "array_count" value comes from the copy_from_user() in
vfio_pci_ioctl_pci_hot_reset(). If the user passes a value larger than
INT_MAX then we'll pass a negative value to kcalloc() which triggers an
allocation failure and a stack trace.
It's better to make the type unsigned so that if (array_count > count)
returns -EINVAL instead.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/vfio/pci/vfio_pci_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 077d4a2629c8..1ab58da9f38a 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -1324,7 +1324,7 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info(
static int
vfio_pci_ioctl_pci_hot_reset_groups(struct vfio_pci_core_device *vdev,
- int array_count, bool slot,
+ u32 array_count, bool slot,
struct vfio_pci_hot_reset __user *arg)
{
int32_t *group_fds;
--
2.45.2
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups()
2024-09-12 8:49 [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups() Dan Carpenter
@ 2024-09-12 13:11 ` Jason Gunthorpe
2024-09-12 20:48 ` Alex Williamson
1 sibling, 0 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2024-09-12 13:11 UTC (permalink / raw)
To: Dan Carpenter
Cc: Alex Williamson, Kevin Tian, Yi Liu, Christian Brauner,
Kunwu Chan, Ankit Agrawal, kvm, linux-kernel, kernel-janitors
On Thu, Sep 12, 2024 at 11:49:10AM +0300, Dan Carpenter wrote:
> The "array_count" value comes from the copy_from_user() in
> vfio_pci_ioctl_pci_hot_reset(). If the user passes a value larger than
> INT_MAX then we'll pass a negative value to kcalloc() which triggers an
> allocation failure and a stack trace.
>
> It's better to make the type unsigned so that if (array_count > count)
> returns -EINVAL instead.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/vfio/pci/vfio_pci_core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups()
2024-09-12 8:49 [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups() Dan Carpenter
2024-09-12 13:11 ` Jason Gunthorpe
@ 2024-09-12 20:48 ` Alex Williamson
1 sibling, 0 replies; 3+ messages in thread
From: Alex Williamson @ 2024-09-12 20:48 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jason Gunthorpe, Kevin Tian, Yi Liu, Christian Brauner,
Kunwu Chan, Ankit Agrawal, kvm, linux-kernel, kernel-janitors
On Thu, 12 Sep 2024 11:49:10 +0300
Dan Carpenter <dan.carpenter@linaro.org> wrote:
> The "array_count" value comes from the copy_from_user() in
> vfio_pci_ioctl_pci_hot_reset(). If the user passes a value larger than
> INT_MAX then we'll pass a negative value to kcalloc() which triggers an
> allocation failure and a stack trace.
>
> It's better to make the type unsigned so that if (array_count > count)
> returns -EINVAL instead.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/vfio/pci/vfio_pci_core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
> index 077d4a2629c8..1ab58da9f38a 100644
> --- a/drivers/vfio/pci/vfio_pci_core.c
> +++ b/drivers/vfio/pci/vfio_pci_core.c
> @@ -1324,7 +1324,7 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info(
>
> static int
> vfio_pci_ioctl_pci_hot_reset_groups(struct vfio_pci_core_device *vdev,
> - int array_count, bool slot,
> + u32 array_count, bool slot,
> struct vfio_pci_hot_reset __user *arg)
> {
> int32_t *group_fds;
Applied to vfio next branch for v6.12. Thanks!
Alex
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-09-12 20:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-09-12 8:49 [PATCH] vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups() Dan Carpenter
2024-09-12 13:11 ` Jason Gunthorpe
2024-09-12 20:48 ` Alex Williamson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®