kernel_optimize_test/drivers/vfio
Alexey Kardashevskiy f705528094 vfio_pci: Test for extended capabilities if config space > 256 bytes
PCI-Express spec says that reading 4 bytes at offset 100h should return
zero if there is no extended capability so VFIO reads this dword to
know if there are extended capabilities.

However it is not always possible to access the extended space so
generic PCI code in pci_cfg_space_size_ext() checks if
pci_read_config_dword() can read beyond 100h and if the check fails,
it sets the config space size to 100h.

VFIO does its own extended capabilities check by reading at offset 100h
which may produce 0xffffffff which VFIO treats as the extended config
space presense and calls vfio_ecap_init() which fails to parse
capabilities (which is expected) but right before the exit, it writes
zero at offset 100h which is beyond the buffer allocated for
vdev->vconfig (which is 256 bytes) which leads to random memory
corruption.

This makes VFIO only check for the extended capabilities if
the discovered config size is more than 256 bytes.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-05-19 15:04:40 -06:00
..
pci vfio_pci: Test for extended capabilities if config space > 256 bytes 2016-05-19 15:04:40 -06:00
platform vfio: fix ioctl error handling 2016-02-28 07:38:52 -07:00
Kconfig vfio: Include No-IOMMU mode 2015-12-21 15:28:11 -07:00
Makefile vfio: Split virqfd into a separate module for vfio bus drivers 2015-03-17 08:33:38 -06:00
vfio_iommu_spapr_tce.c vfio_iommu_spapr_tce: Remove unneeded iommu_group_get_iommudata 2016-04-28 11:12:41 -06:00
vfio_iommu_type1.c vfio: fix ioctl error handling 2016-02-28 07:38:52 -07:00
vfio_spapr_eeh.c drivers/vfio: Support EEH error injection 2015-05-12 20:33:35 +10:00
vfio.c vfio: Add capability chain helpers 2016-02-22 16:10:08 -07:00
virqfd.c vfio: Split virqfd into a separate module for vfio bus drivers 2015-03-17 08:33:38 -06:00