[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH v2] drivers/vfio: Fix a redundant copy bug
In vfio_spapr_iommu_eeh_ioctl(), if the ioctl command is VFIO_EEH_PE_OP,
the user-space buffer 'arg' is copied to the kernel object 'op' and the
'argsz' and 'flags' fields of 'op' are checked. If the check fails, an
error code EINVAL is returned. Otherwise, 'op.op' is further checked
through a switch statement to invoke related handlers. If 'op.op' is
VFIO_EEH_PE_INJECT_ERR, the whole user-space buffer 'arg' is copied again
to 'op' to obtain the err information. However, in the following execution
of this case, the fields of 'op', except the field 'err', are actually not
used. That is, the second copy has a redundant part. Therefore, for both
performance consideration, the redundant part of the second copy should be

This patch removes such a part in the second copy. It only copies from
'err.type' to 'err.mask', which is exactly required by the

Signed-off-by: Wenwen Wang <>
drivers/vfio/vfio_spapr_eeh.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/vfio_spapr_eeh.c b/drivers/vfio/vfio_spapr_eeh.c
index 38edeb4..66634c6 100644
--- a/drivers/vfio/vfio_spapr_eeh.c
+++ b/drivers/vfio/vfio_spapr_eeh.c
@@ -37,6 +37,7 @@ long vfio_spapr_iommu_eeh_ioctl(struct iommu_group *group,
struct eeh_pe *pe;
struct vfio_eeh_pe_op op;
unsigned long minsz;
+ unsigned long start, end;
long ret = -EINVAL;

switch (cmd) {
@@ -86,10 +87,12 @@ long vfio_spapr_iommu_eeh_ioctl(struct iommu_group *group,
ret = eeh_pe_configure(pe);
- minsz = offsetofend(struct vfio_eeh_pe_op, err.mask);
- if (op.argsz < minsz)
+ start = offsetof(struct vfio_eeh_pe_op, err.type);
+ end = offsetofend(struct vfio_eeh_pe_op, err.mask);
+ if (op.argsz < end)
return -EINVAL;
- if (copy_from_user(&op, (void __user *)arg, minsz))
+ if (copy_from_user(&op.err, (char __user *)arg +
+ start, end - start))
return -EFAULT;

ret = eeh_pe_inject_err(pe, op.err.type, op.err.func,
 \ /
  Last update: 2018-10-08 20:06    [W:0.057 / U:7.288 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site