linux-kernel - Re: [PATCH kernel] vfio_pci: Make extended capabilities test more robust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 28 Apr 2016 10:57:00 -0600
From:	Alex Williamson <alex.williamson@...hat.com>
To:	Alexey Kardashevskiy <aik@...abs.ru>
Cc:	kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Gavin Shan <gwshan@...ux.vnet.ibm.com>,
	Alistair Popple <alistair@...ple.id.au>
Subject: Re: [PATCH kernel] vfio_pci: Make extended capabilities test more
 robust

On Thu, 28 Apr 2016 21:04:52 +1000
Alexey Kardashevskiy <aik@...abs.ru> wrote:

> VFIO reads a dword beyond the standard PCI config space (256 bytes) to
> know if there are extended config space (4096 bytes). It relies on
> the platform to return zero if there is no extended space.
> 
> However at least on PPC64/POWERNV platform, the system firmware (OPAL)
> returns 0xffffffff in this case. VFIO treats it as a proof that there is
> extended config space and calls vfio_ecap_init() which fails to parse
> capabilities (which is expected) but right before the exit, it writes
> zero at offset of 256 which is beyond the buffer allocated for
> vdev->vconfig - it is 256 bytes for a device without extended config
> space.
> 
> This adds an additional check that config space read returned non-zero
> and non-ffffffff value.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@...abs.ru>
> ---
>  drivers/vfio/pci/vfio_pci_config.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
> index 142c533..8a53421 100644
> --- a/drivers/vfio/pci/vfio_pci_config.c
> +++ b/drivers/vfio/pci/vfio_pci_config.c
> @@ -1140,7 +1140,7 @@ static int vfio_cap_len(struct vfio_pci_device *vdev, u8 cap, u8 pos)
>  	case PCI_CAP_ID_EXP:
>  		/* Test for extended capabilities */
>  		pci_read_config_dword(pdev, PCI_CFG_SPACE_SIZE, &dword);
> -		vdev->extended_caps = (dword != 0);
> +		vdev->extended_caps = (dword != 0) && (dword != 0xffffffff);
>  
>  		/* length based on version */
>  		if ((pcie_caps_reg(pdev) & PCI_EXP_FLAGS_VERS) == 1)

If the device is already telling us that cfg_size is less, why use
heuristics to figure out what the return value might be, just put the
whole thing in a 'if (pdev->cfg_size > PCI_CFG_SPACE_SIZE)' test.
Looks like the same should be done for PCI-X.  Thanks,

Alex