Unverified Commit 4d478e23 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10655 KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Zucheng <zhengzucheng@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6L7FB5TFQJ4M7LKGJTXSDSVWJQQVSFGC/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAGEKF 
 
Link:https://gitee.com/openeuler/kernel/pulls/10655

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 0e5d0f5f 2f7deea6

arch/powerpc/kvm/book3s_64_vio.c

+13 −5
Original line number Diff line number Diff line
@@ -117,14 +117,16 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
	}

	rcu_read_unlock();



	if (!found) {

		fdput(f);



	if (!found)

		return -EINVAL;

	}



	table_group = iommu_group_get_iommudata(grp);

	if (WARN_ON(!table_group))

	if (WARN_ON(!table_group)) {

		fdput(f);

		return -EFAULT;

	}



	for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {

		struct iommu_table *tbltmp = table_group->tables[i];
@@ -145,8 +147,10 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
			break;

		}

	}

	if (!tbl)

	if (!tbl) {

		fdput(f);

		return -EINVAL;

	}



	rcu_read_lock();

	list_for_each_entry_rcu(stit, &stt->iommu_tables, next) {
@@ -157,6 +161,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
			/* stit is being destroyed */

			iommu_tce_table_put(tbl);

			rcu_read_unlock();

			fdput(f);

			return -ENOTTY;

		}

		/*
@@ -164,6 +169,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
		 * its KVM reference counter and can return.

		 */

		rcu_read_unlock();

		fdput(f);

		return 0;

	}

	rcu_read_unlock();
@@ -171,6 +177,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 
	stit = kzalloc(sizeof(*stit), GFP_KERNEL);

	if (!stit) {

		iommu_tce_table_put(tbl);

		fdput(f);

		return -ENOMEM;

	}
@@ -179,6 +186,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, 


	list_add_rcu(&stit->next, &stt->iommu_tables);



	fdput(f);

	return 0;

}