diff options
| author | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 2015-11-02 18:07:44 -0500 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2016-03-16 10:38:19 +0100 |
| commit | d8e0a80d370c6608fb96cd371948ccd6497153f1 (patch) | |
| tree | a5531e5cef6d1b197d603cce3b8a90319fd95936 | |
| parent | 0842f7d8a78ff7f9c3a176abaa620a220fc82e75 (diff) | |
| download | linux-stable-d8e0a80d370c6608fb96cd371948ccd6497153f1.tar.gz linux-stable-d8e0a80d370c6608fb96cd371948ccd6497153f1.tar.bz2 linux-stable-d8e0a80d370c6608fb96cd371948ccd6497153f1.zip | |
xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.
The guest sequence of:
a) XEN_PCI_OP_enable_msix
b) XEN_PCI_OP_enable_msix
results in hitting an NULL pointer due to using freed pointers.
The device passed in the guest MUST have MSI-X capability.
The a) constructs and SysFS representation of MSI and MSI groups.
The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
in a) pdev->msi_irq_groups is still set) and also free's ALL of the
MSI-X entries of the device (the ones allocated in step a) and b)).
The unwind code: 'free_msi_irqs' deletes all the entries and tries to
delete the pdev->msi_irq_groups (which hasn't been set to NULL).
However the pointers in the SysFS are already freed and we hit an
NULL pointer further on when 'strlen' is attempted on a freed pointer.
The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
against that. The check for msi_enabled is not stricly neccessary.
This is part of XSA-157
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
| -rw-r--r-- | drivers/xen/xen-pciback/pciback_ops.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c index 37452734af98..32cbafcece76 100644 --- a/drivers/xen/xen-pciback/pciback_ops.c +++ b/drivers/xen/xen-pciback/pciback_ops.c @@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev, if (unlikely(verbose_request)) printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n", pci_name(dev)); + if (op->value > SH_INFO_MAX_VEC) return -EINVAL; + if (dev->msix_enabled) + return -EALREADY; + + if (dev->msi_enabled) + return -ENXIO; + entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL); if (entries == NULL) return -ENOMEM; |