Joerg Roedel e324fc82ea vfio: Fix bug in vfio_device_get_from_name() ... The vfio_device_get_from_name() function might return a non-NULL pointer, when called with a device name that is not found in the list. This causes undefined behavior, in my case calling an invalid function pointer later on: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle kernel paging request at ffff8800cb3ddc08 [...] Call Trace: [<ffffffffa03bd733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio] [<ffffffff811efc4d>] do_vfs_ioctl+0x2cd/0x4c0 [<ffffffff811f9657>] ? __fget+0x77/0xb0 [<ffffffff811efeb9>] SyS_ioctl+0x79/0x90 [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130 [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75 Fix the issue by returning NULL when there is no device with the requested name in the list. Cc: stable@vger.kernel.org # v4.2+ Fixes: 4bc94d5dc9 ("vfio: Fix lockdep issue") Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>		2015-11-04 09:27:39 -07:00
..
pci	vfio/pci: Use kernel VPD access functions	2015-10-27 14:53:05 -06:00
platform	VFIO: platform: reset: AMD xgbe reset module	2015-11-03 12:55:21 -07:00
Kconfig	drivers/vfio: Allow type-1 IOMMU instantiation on top of an ARM SMMUv3	2015-05-29 11:12:40 +02:00
Makefile	vfio: Split virqfd into a separate module for vfio bus drivers	2015-03-17 08:33:38 -06:00
vfio_iommu_spapr_tce.c	vfio: powerpc/spapr: Support Dynamic DMA windows	2015-06-11 15:16:55 +10:00
vfio_iommu_type1.c	vfio/type1: handle case where IOMMU does not support PAGE_SIZE size	2015-11-03 12:53:53 -07:00
vfio_spapr_eeh.c	drivers/vfio: Support EEH error injection	2015-05-12 20:33:35 +10:00
vfio.c	vfio: Fix bug in vfio_device_get_from_name()	2015-11-04 09:27:39 -07:00
virqfd.c	vfio: Split virqfd into a separate module for vfio bus drivers	2015-03-17 08:33:38 -06:00