From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael S. Tsirkin" Subject: Re: [PATCH net] vhost/net: fix heads usage of ubuf_info Date: Sun, 17 Mar 2013 20:50:22 +0200 Message-ID: <20130317185022.GA22517@redhat.com> References: <20130317124609.GA25967@redhat.com> <20130317.142955.1114572401286297685.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20130317.142955.1114572401286297685.davem@davemloft.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: virtualization-bounces@lists.linux-foundation.org Errors-To: virtualization-bounces@lists.linux-foundation.org To: David Miller Cc: kvm@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, nab@risingtidesystems.com, virtualization@lists.linux-foundation.org, stable@kernel.org, basil.gor@gmail.com List-Id: virtualization@lists.linuxfoundation.org On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > From: "Michael S. Tsirkin" > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > ubuf info allocator uses guest controlled head as an index, > > so a malicious guest could put the same head entry in the ring twice, > > and we will get two callbacks on the same value. > > To fix use upend_idx which is guaranteed to be unique. > > > > Reported-by: Rusty Russell > > Signed-off-by: Michael S. Tsirkin > > Applied and queued up for -stable, thanks. OK I'll drop it from my tree then. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756593Ab3CQStz (ORCPT ); Sun, 17 Mar 2013 14:49:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60829 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755751Ab3CQSty (ORCPT ); Sun, 17 Mar 2013 14:49:54 -0400 Date: Sun, 17 Mar 2013 20:50:22 +0200 From: "Michael S. Tsirkin" To: David Miller Cc: stable@kernel.org, rusty@rustcorp.com.au, jasowang@redhat.com, basil.gor@gmail.com, nab@risingtidesystems.com, kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net] vhost/net: fix heads usage of ubuf_info Message-ID: <20130317185022.GA22517@redhat.com> References: <20130317124609.GA25967@redhat.com> <20130317.142955.1114572401286297685.davem@davemloft.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20130317.142955.1114572401286297685.davem@davemloft.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > From: "Michael S. Tsirkin" > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > ubuf info allocator uses guest controlled head as an index, > > so a malicious guest could put the same head entry in the ring twice, > > and we will get two callbacks on the same value. > > To fix use upend_idx which is guaranteed to be unique. > > > > Reported-by: Rusty Russell > > Signed-off-by: Michael S. Tsirkin > > Applied and queued up for -stable, thanks. OK I'll drop it from my tree then.