linux-kernel - [PATCH 4.18 120/135] s390/cio: Fix how vfio-ccw checks pinned pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181016170523.580157844@linuxfoundation.org>
Date:   Tue, 16 Oct 2018 19:05:50 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Eric Farman <farman@...ux.ibm.com>,
        Cornelia Huck <cohuck@...hat.com>
Subject: [PATCH 4.18 120/135] s390/cio: Fix how vfio-ccw checks pinned pages

4.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Farman <farman@...ux.ibm.com>

commit 24abf2901b18bf941b9f21ea2ce5791f61097ae4 upstream.

We have two nested loops to check the entries within the pfn_array_table
arrays.  But we mistakenly use the outer array as an index in our check,
and completely ignore the indexing performed by the inner loop.

Cc: stable@...r.kernel.org
Signed-off-by: Eric Farman <farman@...ux.ibm.com>
Message-Id: <20181002010235.42483-1-farman@...ux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@...hat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/s390/cio/vfio_ccw_cp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -163,7 +163,7 @@ static bool pfn_array_table_iova_pinned(
 
 	for (i = 0; i < pat->pat_nr; i++, pa++)
 		for (j = 0; j < pa->pa_nr; j++)
-			if (pa->pa_iova_pfn[i] == iova_pfn)
+			if (pa->pa_iova_pfn[j] == iova_pfn)
 				return true;
 
 	return false;