From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:42767 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752256AbbI3Dcl (ORCPT ); Tue, 29 Sep 2015 23:32:41 -0400 Subject: Patch "macvtap: fix TUNSETSNDBUF values > 64k" has been added to the 4.2-stable tree To: mst@redhat.com, borntraeger@de.ibm.com, davem@davemloft.net, gregkh@linuxfoundation.org, mjrosato@linux.vnet.ibm.com Cc: , From: Date: Wed, 30 Sep 2015 05:32:00 +0200 Message-ID: <1443583920170134@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled macvtap: fix TUNSETSNDBUF values > 64k to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: macvtap-fix-tunsetsndbuf-values-64k.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Wed Sep 30 05:25:07 CEST 2015 From: "Michael S. Tsirkin" Date: Fri, 18 Sep 2015 13:41:09 +0300 Subject: macvtap: fix TUNSETSNDBUF values > 64k From: "Michael S. Tsirkin" [ Upstream commit 3ea79249e81e5ed051f2e6480cbde896d99046e8 ] Upon TUNSETSNDBUF, macvtap reads the requested sndbuf size into a local variable u. commit 39ec7de7092b ("macvtap: fix uninitialized access on TUNSETIFF") changed its type to u16 (which is the right thing to do for all other macvtap ioctls), breaking all values > 64k. The value of TUNSETSNDBUF is actually a signed 32 bit integer, so the right thing to do is to read it into an int. Cc: David S. Miller Fixes: 39ec7de7092b ("macvtap: fix uninitialized access on TUNSETIFF") Reported-by: Mark A. Peloquin Bisected-by: Matthew Rosato Reported-by: Christian Borntraeger Signed-off-by: Michael S. Tsirkin Tested-by: Matthew Rosato Acked-by: Christian Borntraeger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvtap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -1111,10 +1111,10 @@ static long macvtap_ioctl(struct file *f return 0; case TUNSETSNDBUF: - if (get_user(u, up)) + if (get_user(s, sp)) return -EFAULT; - q->sk.sk_sndbuf = u; + q->sk.sk_sndbuf = s; return 0; case TUNGETVNETHDRSZ: Patches currently in stable-queue which might be from mst@redhat.com are queue-4.2/macvtap-fix-tunsetsndbuf-values-64k.patch