vfio-pci: Fix buffer overfill

PATCH New Alex Williamson 1 participant 1 message Jan 15, 2013

Subsystems (2)

KVM VFIO driver

lore

Share & tools

lore

Alex Williamson

author

2013-01-15 03:27 UTC #0 lore raw

PATCH 1/1 vfio-pci: Fix buffer overfill

A read from a range hidden from the user (ex. MSI-X vector table) attempts to fill the user buffer up to the end of the excluded range instead of up to the requested count. Fix it.

Signed-off-by Alex Williamson <[email protected]>

Cc [email protected]

---
 drivers/vfio/pci/vfio_pci_rdwr.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/vfio/pci/vfio_pci_rdwr.c +2 -2

index 4362d9e..f72323e 100644
@@ -240,17 +240,17 @@ ssize_t vfio_pci_mem_readwrite(struct vfio_pci_device *vdev, char __user *buf,
 			filled = 1;
 		} else {
 			/* Drop writes, fill reads with FF */
+			filled = min((size_t)(x_end - pos), count);
 			if (!iswrite) {
 				char val = 0xFF;
 				size_t i;
 
-				for (i = 0; i < x_end - pos; i++) {
+				for (i = 0; i < filled; i++) {
 					if (put_user(val, buf + i))
 						goto out;
 				}
 			}
 
-			filled = x_end - pos;
 		}
 
 		count -= filled;