From patchwork Wed Oct 12 16:51:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlad Tsyrklevich X-Patchwork-Id: 9373631 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A1A3D60839 for ; Wed, 12 Oct 2016 17:44:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9114629327 for ; Wed, 12 Oct 2016 17:44:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 85F5E2936E; Wed, 12 Oct 2016 17:44:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DB33D29327 for ; Wed, 12 Oct 2016 17:44:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932454AbcJLRoO (ORCPT ); Wed, 12 Oct 2016 13:44:14 -0400 Received: from mail-lf0-f66.google.com ([209.85.215.66]:35079 "EHLO mail-lf0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754538AbcJLRoK (ORCPT ); Wed, 12 Oct 2016 13:44:10 -0400 Received: by mail-lf0-f66.google.com with SMTP id x79so8257198lff.2 for ; Wed, 12 Oct 2016 10:43:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=QcxiyyWGh19DlMk4mxswIzJ7rY8NufcVs48JQJdRy6A=; b=p+BPNM20rYCA2RSBmFLc1JWE0b4cGyHM0N20Y9wlcsRkasnI8OmtglctRjBLyW4vlo 7qKZfTyctIE/pAZP4gElyfKSQpIK55+862y3GgS7IcCgW900erLfjUpOBqF2unelHQiK 4sNClURPT4LNOjSzEKC7JVZejW4myiKB9B9rNt+DAS0Gh0f37G16L86HMDDD2bZACoTI Wfcy8+o5PAzZQKLoN7OW5GzoL+Xu+r3tLQcthOPNHkSgysUCdd+BU/WX/z89q/e9ae/D t4CmBdefGglFZ71Kz6t/mti2rDpWjG32N2Nd6g2Pkt24uqOS/dFng5YufDWcZJkZkbxO NfaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=QcxiyyWGh19DlMk4mxswIzJ7rY8NufcVs48JQJdRy6A=; b=PS9f3Bs7UILzBrFSSZCCIrLVujySifL5F+hh/tQELmY38bhaN/09GpxDigzXP+T5fV EGx6BwTJxTODvcLnGmcSBa8cALvoDMxYDJ1j2tcoVLjypsWm8rshPVjHrg8FPXhXy72s CC+nJRgUiK0Mmp/PPbuo08ir1gKw6qJdc+EV51Ypr8UoSb10S3NWQU87OzryWZUJUqL3 qgSzrJEJuy38g2C8C+w7N7MPXFwfodaPlUPcrioxBn7Q76txRkVnRfy9zj+8j26omEip EtVvOBVAMgHtPJj9lCpg5N9vYZOF4pHbzOAuYfvtmYc3em6gsyiDdx/HLPyFI2tUTd4J vimg== X-Gm-Message-State: AA6/9Rlwu4X8BSbQYbjQsSYBuvA79ezzOVV0Z8+yvJsypS3Y4VVQ6z24nZl9hAfc30L1Ow== X-Received: by 10.194.86.201 with SMTP id r9mr2917145wjz.5.1476291148521; Wed, 12 Oct 2016 09:52:28 -0700 (PDT) Received: from Vlads-MBP.fritz.box (pD9F6BA01.dip0.t-ipconnect.de. [217.246.186.1]) by smtp.gmail.com with ESMTPSA id c7sm14332896wjk.19.2016.10.12.09.52.27 (version=TLS1 cipher=AES128-SHA bits=128/128); Wed, 12 Oct 2016 09:52:27 -0700 (PDT) From: Vlad Tsyrklevich To: kvm@vger.kernel.org Cc: alex.williamson@redhat.com, Vlad Tsyrklevich Subject: [PATCH v3] vfio/pci: Fix integer overflows, bitmask check Date: Wed, 12 Oct 2016 18:51:24 +0200 Message-Id: <1476291084-50737-1-git-send-email-vlad@tsyrklevich.net> X-Mailer: git-send-email 2.7.0 In-Reply-To: <20161012093959.0f7ba9dc@t450s.home> References: <20161012093959.0f7ba9dc@t450s.home> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize user-supplied integers, potentially allowing memory corruption. This patch adds appropriate integer overflow checks, checks the range bounds for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set. VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in vfio_pci_set_irqs_ioctl(). Furthermore, a kzalloc is changed to a kcalloc because the use of a kzalloc with an integer multiplication allowed an integer overflow condition to be reached without this patch. kcalloc checks for overflow and should prevent a similar occurrence. Signed-off-by: Vlad Tsyrklevich --- drivers/vfio/pci/vfio_pci.c | 33 +++++++++++++++++++++------------ drivers/vfio/pci/vfio_pci_intrs.c | 2 +- 2 files changed, 22 insertions(+), 13 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index d624a52..031bc08 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -829,8 +829,9 @@ static long vfio_pci_ioctl(void *device_data, } else if (cmd == VFIO_DEVICE_SET_IRQS) { struct vfio_irq_set hdr; + size_t size; u8 *data = NULL; - int ret = 0; + int max, ret = 0; minsz = offsetofend(struct vfio_irq_set, count); @@ -838,23 +839,31 @@ static long vfio_pci_ioctl(void *device_data, return -EFAULT; if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS || + hdr.count >= (U32_MAX - hdr.start) || hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK | VFIO_IRQ_SET_ACTION_TYPE_MASK)) return -EINVAL; - if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) { - size_t size; - int max = vfio_pci_get_irq_count(vdev, hdr.index); + max = vfio_pci_get_irq_count(vdev, hdr.index); + if (hdr.start >= max || hdr.start + hdr.count > max) + return -EINVAL; - if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL) - size = sizeof(uint8_t); - else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD) - size = sizeof(int32_t); - else - return -EINVAL; + switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) { + case VFIO_IRQ_SET_DATA_NONE: + size = 0; + break; + case VFIO_IRQ_SET_DATA_BOOL: + size = sizeof(uint8_t); + break; + case VFIO_IRQ_SET_DATA_EVENTFD: + size = sizeof(int32_t); + break; + default: + return -EINVAL; + } - if (hdr.argsz - minsz < hdr.count * size || - hdr.start >= max || hdr.start + hdr.count > max) + if (size) { + if (hdr.argsz - minsz < hdr.count * size) return -EINVAL; data = memdup_user((void __user *)(arg + minsz), diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c index c2e6089..1c46045 100644 --- a/drivers/vfio/pci/vfio_pci_intrs.c +++ b/drivers/vfio/pci/vfio_pci_intrs.c @@ -256,7 +256,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) if (!is_irq_none(vdev)) return -EINVAL; - vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL); + vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL); if (!vdev->ctx) return -ENOMEM;