github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vfio/qat: fix f_pos race in qat_vf_resume_write()

Browse Source 
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
copies into the migration-state buffer after taking the lock and
re-reading the shared file position.

Two concurrent writers could therefore pass the bounds check with the
old offset, then have the second writer copy after the first advanced
f_pos, writing past the end of the migration-state buffer.

Take migf->lock before doing the boundary checks.

Fixes: bb208810b1 ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Link: https://lore.kernel.org/r/20260608151317.136613-1-giovanni.cabiddu@intel.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
This commit is contained in:
Giovanni Cabiddu 2026-06-08 16:12:57 +01:00 committed by Alex Williamson
parent a26b499b75
commit 4ec5e932e6
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/vfio/pci/qat/main.c
View File

@ -298,14 +298,18 @@ static ssize_t qat_vf_resume_write(struct file *filp, const char __user *buf,
return -ESPIPE;
offs = &filp->f_pos;
if (*offs < 0 ||
check_add_overflow(len, *offs, &end))
return -EOVERFLOW;
if (end > mig_dev->state_size)
return -ENOMEM;
mutex_lock(&migf->lock);
if (*offs < 0 || check_add_overflow(len, *offs, &end)) {
done = -EOVERFLOW;
goto out_unlock;
}
if (end > mig_dev->state_size) {
done = -ENOMEM;
goto out_unlock;
}
if (migf->disabled) {
done = -ENODEV;
goto out_unlock;