Commit 2f03f21f authored by Raghavendra Rao Ananta's avatar Raghavendra Rao Ananta Committed by Alex Williamson
Browse files

vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd() 



For the cases where user includes a non-zero value in 'token_uuid_ptr'
field of 'struct vfio_device_bind_iommufd', the copy_struct_from_user()
in vfio_df_ioctl_bind_iommufd() fails with -E2BIG. For the 'minsz' passed,
copy_struct_from_user() expects the newly introduced field to be zero-ed,
which would be incorrect in this case.

Fix this by passing the actual size of the kernel struct. If working
with a newer userspace, copy_struct_from_user() would copy the
'token_uuid_ptr' field, and if working with an old userspace, it would
zero out this field, thus still retaining backward compatibility.

Fixes: 86624ba3 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@google.com>
Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20251031170603.2260022-2-rananta@google.com


Signed-off-by: default avatarAlex Williamson <alex@shazbot.org>
parent 2131c151

drivers/vfio/device_cdev.c

+1 −1
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df, 
		return ret;

	if (user_size < minsz)

		return -EINVAL;

	ret = copy_struct_from_user(&bind, minsz, arg, user_size);

	ret = copy_struct_from_user(&bind, sizeof(bind), arg, user_size);

	if (ret)

		return ret;