Commit 58b09b08 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Luis Henriques

vfio: fix ioctl error handling

commit 8160c4e4 upstream.

Calling return copy_to_user(...) in an ioctl will not
do the right thing if there's a pagefault:
copy_to_user returns the number of bytes not copied
in this case.

Fix up vfio to do
	return copy_to_user(...)) ?
		-EFAULT : 0;

everywhere.
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
[ luis: backported to 3.16:
  - dropped changes to vfio_platform_common.c ]
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 740b87f7
......@@ -346,7 +346,8 @@ static long vfio_pci_ioctl(void *device_data,
info.num_regions = VFIO_PCI_NUM_REGIONS;
info.num_irqs = VFIO_PCI_NUM_IRQS;
return copy_to_user((void __user *)arg, &info, minsz);
return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0;
} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
struct pci_dev *pdev = vdev->pdev;
......@@ -419,7 +420,8 @@ static long vfio_pci_ioctl(void *device_data,
return -EINVAL;
}
return copy_to_user((void __user *)arg, &info, minsz);
return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0;
} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
struct vfio_irq_info info;
......@@ -453,7 +455,8 @@ static long vfio_pci_ioctl(void *device_data,
else
info.flags |= VFIO_IRQ_INFO_NORESIZE;
return copy_to_user((void __user *)arg, &info, minsz);
return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0;
} else if (cmd == VFIO_DEVICE_SET_IRQS) {
struct vfio_irq_set hdr;
......
......@@ -908,7 +908,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
info.iova_pgsizes = vfio_pgsize_bitmap(iommu);
return copy_to_user((void __user *)arg, &info, minsz);
return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0;
} else if (cmd == VFIO_IOMMU_MAP_DMA) {
struct vfio_iommu_type1_dma_map map;
......@@ -941,7 +942,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
if (ret)
return ret;
return copy_to_user((void __user *)arg, &unmap, minsz);
return copy_to_user((void __user *)arg, &unmap, minsz) ?
-EFAULT : 0;
}
return -ENOTTY;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment