• Alex Williamson's avatar
    vfio/pci: Fix NULL pointer oops in error interrupt setup handling · c8952a70
    Alex Williamson authored
    There are multiple cases in vfio_pci_set_ctx_trigger_single() where
    we assume we can safely read from our data pointer without actually
    checking whether the user has passed any data via the count field.
    VFIO_IRQ_SET_DATA_NONE in particular is entirely broken since we
    attempt to pull an int32_t file descriptor out before even checking
    the data type.  The other data types assume the data pointer contains
    one element of their type as well.
    
    In part this is good news because we were previously restricted from
    doing much sanitization of parameters because it was missed in the
    past and we didn't want to break existing users.  Clearly DATA_NONE
    is completely broken, so it must not have any users and we can fix
    it up completely.  For DATA_BOOL and DATA_EVENTFD, we'll just
    protect ourselves, returning error when count is zero since we
    previously would have oopsed.
    Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
    Reported-by: default avatarChris Thompson <the_cartographer@hotmail.com>
    Cc: stable@vger.kernel.org
    Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
    c8952a70
vfio_pci_intrs.c 16.1 KB