You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.2 KiB
64 lines
2.2 KiB
From 19b33b70d423ddfea1daf7615eb7f605371a1841 Mon Sep 17 00:00:00 2001
|
|
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
Date: Mon, 2 Nov 2015 18:07:44 -0500
|
|
Subject: [PATCH v2 XSA157 2/5] xen/pciback: Return error on
|
|
XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
|
|
|
|
The guest sequence of:
|
|
|
|
a) XEN_PCI_OP_enable_msix
|
|
b) XEN_PCI_OP_enable_msix
|
|
|
|
results in hitting an NULL pointer due to using freed pointers.
|
|
|
|
The device passed in the guest MUST have MSI-X capability.
|
|
|
|
The a) constructs and SysFS representation of MSI and MSI groups.
|
|
The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
|
|
'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
|
|
in a) pdev->msi_irq_groups is still set) and also free's ALL of the
|
|
MSI-X entries of the device (the ones allocated in step a) and b)).
|
|
|
|
The unwind code: 'free_msi_irqs' deletes all the entries and tries to
|
|
delete the pdev->msi_irq_groups (which hasn't been set to NULL).
|
|
However the pointers in the SysFS are already freed and we hit an
|
|
NULL pointer further on when 'strlen' is attempted on a freed pointer.
|
|
|
|
The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
|
|
against that. The check for msi_enabled is not stricly neccessary.
|
|
|
|
This is part of XSA-157
|
|
|
|
CC: stable@vger.kernel.org
|
|
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
|
|
Reviewed-by: Jan Beulich <jbeulich@suse.com>
|
|
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
---
|
|
drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
|
|
index 5ce573a..a107928 100644
|
|
--- a/drivers/xen/xen-pciback/pciback_ops.c
|
|
+++ b/drivers/xen/xen-pciback/pciback_ops.c
|
|
@@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
|
|
if (unlikely(verbose_request))
|
|
printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
|
|
pci_name(dev));
|
|
+
|
|
if (op->value > SH_INFO_MAX_VEC)
|
|
return -EINVAL;
|
|
|
|
+ if (dev->msix_enabled)
|
|
+ return -EALREADY;
|
|
+
|
|
+ if (dev->msi_enabled)
|
|
+ return -ENXIO;
|
|
+
|
|
entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
|
|
if (entries == NULL)
|
|
return -ENOMEM;
|
|
--
|
|
2.1.0
|
|
|