History

vhost: move vdpa group bound check to vhost_vdpa

Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.

Eugenio Pérez committed 10 months ago

Commit cd025c11 parent 74bc5f63 files · +1 −10Browse files

Unified · Split

3 files
  1. drivers/vdpa/mlx5/net/mlx5_vnet.c +0 −3
  2. drivers/vdpa/vdpa_sim/vdpa_sim.c +0 −6
  3. drivers/vhost/vdpa.c +1 −1
drivers/vdpa/mlx5/net/mlx5_vnet.c+0−3
@@ -3640,9 +3640,6 @@ static int mlx5_set_group_asid(struct vdpa_device *vdev, u32 group, · 3639 unmodified lines
36403640 struct mlx5_vdpa_dev *mvdev = to_mvdev(vdev);
36413641 int err = 0;
36423642
3643− if (group >= MLX5_VDPA_NUMVQ_GROUPS)
3644− return -EINVAL;
3645−
36463643 mvdev->mres.group2asid[group] = asid;
36473644
36483645 mutex_lock(&mvdev->mres.lock);
drivers/vdpa/vdpa_sim/vdpa_sim.c+0−6
@@ -606,12 +606,6 @@ static int vdpasim_set_group_asid(struct vdpa_device *vdpa, unsigned int group, · 605 unmodified lines
606606 struct vhost_iotlb *iommu;
607607 int i;
608608
609− if (group > vdpasim->dev_attr.ngroups)
610− return -EINVAL;
611−
612− if (asid >= vdpasim->dev_attr.nas)
613− return -EINVAL;
614−
615609 iommu = &vdpasim->iommu[asid];
616610
617611 mutex_lock(&vdpasim->mutex);
drivers/vhost/vdpa.c+1−1
@@ -680,7 +680,7 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, · 679 unmodified lines
680680 case VHOST_VDPA_SET_GROUP_ASID:
681681 if (copy_from_user(&s, argp, sizeof(s)))
682682 return -EFAULT;
683− if (s.num >= vdpa->nas)
683+ if (idx >= vdpa->ngroups || s.num >= vdpa->nas)
684684 return -EINVAL;
685685 if (!ops->set_group_asid)
686686 return -EOPNOTSUPP;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t