diff options
| author | Joerg Roedel <[email protected]> | 2015-11-04 12:53:26 +0000 |
|---|---|---|
| committer | Alex Williamson <[email protected]> | 2015-11-04 16:27:39 +0000 |
| commit | e324fc82ea453fcbd3898ec7afb792f750c68979 (patch) | |
| tree | 914d7b4679b70b623a2784cc71e5a78f1e1acbf5 /drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | |
| parent | VFIO: platform: reset: AMD xgbe reset module (diff) | |
| download | kernel-e324fc82ea453fcbd3898ec7afb792f750c68979.tar.gz kernel-e324fc82ea453fcbd3898ec7afb792f750c68979.zip | |
vfio: Fix bug in vfio_device_get_from_name()
The vfio_device_get_from_name() function might return a
non-NULL pointer, when called with a device name that is not
found in the list. This causes undefined behavior, in my
case calling an invalid function pointer later on:
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8800cb3ddc08
[...]
Call Trace:
[<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
[<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0
[<ffffffff811f9657>] ? __fget+0x77/0xb0
[<ffffffff811efeb9>] SyS_ioctl+0x79/0x90
[<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
[<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75
Fix the issue by returning NULL when there is no device with
the requested name in the list.
Cc: [email protected] # v4.2+
Fixes: 4bc94d5dc95d ("vfio: Fix lockdep issue")
Signed-off-by: Joerg Roedel <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c')
0 files changed, 0 insertions, 0 deletions