linux-kernel - Re: [PATCH] vfio: fix vfio_info_cap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Nov 2016 19:52:58 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Eric Auger <eric.auger@...hat.com>, eric.auger.pro@...il.com,
        alex.williamson@...hat.com, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Subject: Re: [PATCH] vfio: fix vfio_info_cap_add/shift

Am 21.11.2016 um 07:21 schrieb Eric Auger:
> Capability header next field is an offset relative to the start of
> the INFO buffer. tmp->next is assigned the proper value but iterations
> implemented in vfio_info_cap_add and vfio_info_cap_shift use next
> as an offset between the headers. When coping with multiple capabilities
> this leads to an Oops.
>
> Signed-off-by: Eric Auger <eric.auger@...hat.com>
> ---
>  drivers/vfio/vfio.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index d1d70e0..1e838d1 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1763,7 +1763,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps,
>  	header->version = version;
>
>  	/* Add to the end of the capability chain */
> -	for (tmp = caps->buf; tmp->next; tmp = (void *)tmp + tmp->next)
> +	for (tmp = buf; tmp->next; tmp = buf + tmp->next)
>  		; /* nothing */
>

Looks sane to me, tmp->next is always set to the old size, which 
corresponds to the offset from the start of the buffer.

>  	tmp->next = caps->size;
> @@ -1776,8 +1776,9 @@ EXPORT_SYMBOL_GPL(vfio_info_cap_add);
>  void vfio_info_cap_shift(struct vfio_info_cap *caps, size_t offset)
>  {
>  	struct vfio_info_cap_header *tmp;
> +	void *buf = (void *)caps->buf;
>
> -	for (tmp = caps->buf; tmp->next; tmp = (void *)tmp + tmp->next - offset)
> +	for (tmp = buf; tmp->next; tmp = buf + tmp->next - offset)
>  		tmp->next += offset;


Reviewed-by: David Hildenbrand <david@...hat.com>

-- 

David