lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 7 Oct 2018 09:44:25 -0500 From: Wenwen Wang <wang6495@....edu> To: Wenwen Wang <wang6495@....edu> Cc: Kangjie Lu <kjlu@....edu>, Alex Williamson <alex.williamson@...hat.com>, kvm@...r.kernel.org (open list:VFIO DRIVER), linux-kernel@...r.kernel.org (open list) Subject: [PATCH] drivers/vfio: Fix a redundant copy bug In vfio_spapr_iommu_eeh_ioctl(), if the ioctl command is VFIO_EEH_PE_OP, the user-space buffer 'arg' is copied to the kernel object 'op' and the 'argsz' and 'flags' fields of 'op' are checked. If the check fails, an error code EINVAL is returned. Otherwise, 'op.op' is further checked through a switch statement to invoke related handlers. If 'op.op' is VFIO_EEH_PE_INJECT_ERR, the whole user-space buffer 'arg' is copied again to 'op' to obtain the err information. However, in the following execution of this case, the fields of 'op', except the field 'err', are actually not used. That is, the second copy has a redundant part. Therefore, for both performance and security reasons, the redundant part of the second copy should be removed. This patch removes such a part in the second copy. It only copies the 'err' information from the buffer 'arg'. Signed-off-by: Wenwen Wang <wang6495@....edu> --- drivers/vfio/vfio_spapr_eeh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/vfio_spapr_eeh.c b/drivers/vfio/vfio_spapr_eeh.c index 38edeb4..5bc4b60 100644 --- a/drivers/vfio/vfio_spapr_eeh.c +++ b/drivers/vfio/vfio_spapr_eeh.c @@ -86,10 +86,10 @@ long vfio_spapr_iommu_eeh_ioctl(struct iommu_group *group, ret = eeh_pe_configure(pe); break; case VFIO_EEH_PE_INJECT_ERR: - minsz = offsetofend(struct vfio_eeh_pe_op, err.mask); - if (op.argsz < minsz) + if (op.argsz < sizeof(op)) return -EINVAL; - if (copy_from_user(&op, (void __user *)arg, minsz)) + if (copy_from_user(&op.err, (char __user *)arg + + minsz, sizeof(op.err))) return -EFAULT; ret = eeh_pe_inject_err(pe, op.err.type, op.err.func, -- 2.7.4
Powered by blists - more mailing lists