• Joerg Roedel's avatar
    vfio: Fix bug in vfio_device_get_from_name() · e324fc82
    Joerg Roedel authored
    The vfio_device_get_from_name() function might return a
    non-NULL pointer, when called with a device name that is not
    found in the list. This causes undefined behavior, in my
    case calling an invalid function pointer later on:
    
     kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
     BUG: unable to handle kernel paging request at ffff8800cb3ddc08
    
    [...]
    
     Call Trace:
      [<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
      [<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0
      [<ffffffff811f9657>] ? __fget+0x77/0xb0
      [<ffffffff811efeb9>] SyS_ioctl+0x79/0x90
      [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
      [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75
    
    Fix the issue by returning NULL when there is no device with
    the requested name in the list.
    
    Cc: stable@vger.kernel.org # v4.2+
    Fixes: 4bc94d5d ("vfio: Fix lockdep issue")
    Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
    Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
    e324fc82
vfio.c 40.8 KB