Commit 90929078 authored by Christian A. Ehrhardt's avatar Christian A. Ehrhardt Committed by Alex Williamson
Browse files

vfio/pci: Add missing range check in vfio_pci_mmap 



When mmaping an extra device region verify that the region index
derived from the mmap offset is valid.

Fixes: a15b1883 ("vfio_pci: Allow mapping extra regions")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarChristian A. Ehrhardt <lk@c--e.de>
Message-Id: <20210412214124.GA241759@lisa.in-ulm.de>
Reviewed-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
parent d434405a

drivers/vfio/pci/vfio_pci.c

+3 −1
Original line number Diff line number Diff line
@@ -1656,6 +1656,8 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) 


	index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT);



	if (index >= VFIO_PCI_NUM_REGIONS + vdev->num_regions)

		return -EINVAL;

	if (vma->vm_end < vma->vm_start)

		return -EINVAL;

	if ((vma->vm_flags & VM_SHARED) == 0)
@@ -1664,7 +1666,7 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) 
		int regnum = index - VFIO_PCI_NUM_REGIONS;

		struct vfio_pci_region *region = vdev->region + regnum;



		if (region && region->ops && region->ops->mmap &&

		if (region->ops && region->ops->mmap &&

		    (region->flags & VFIO_REGION_INFO_FLAG_MMAP))

			return region->ops->mmap(vdev, region, vma);

		return -EINVAL;