From: Andrea Parri <parri.andrea@gmail.com>
To: Michael Kelley <mikelley@microsoft.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
KY Srinivasan <kys@microsoft.com>,
Haiyang Zhang <haiyangz@microsoft.com>,
Stephen Hemminger <sthemmin@microsoft.com>,
Wei Liu <wei.liu@kernel.org>,
"linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
Juan Vazquez <juvazq@microsoft.com>,
Saruhan Karademir <skarade@microsoft.com>
Subject: Re: [PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()
Date: Sun, 6 Dec 2020 19:20:38 +0100 [thread overview]
Message-ID: <20201206182038.GC3256@andrea> (raw)
In-Reply-To: <MW2PR2101MB1052C82219AB1CEDA949B4EAD7CF1@MW2PR2101MB1052.namprd21.prod.outlook.com>
On Sun, Dec 06, 2020 at 05:14:18PM +0000, Michael Kelley wrote:
> From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Sent: Wednesday, November 18, 2020 6:37 AM
> >
> > vmbus_on_msg_dpc() double fetches from payload_size. The double fetch
> > can lead to a buffer overflow when (mem)copying the hv_message object.
> > Avoid the double fetch by saving the value of payload_size into a local
> > variable.
>
> Similar comment here about providing some brief context in the commit
> message on the problem that we are guarding against by removing the
> double fetch.
Will expand.
>
> I could see combining this patch with the previous one since the
> motivation and pattern of the changes are exactly the same, just for
> two different fields.
Will consider this suggestion for v3. Please see v2 for a related
discussion.
Andrea
next prev parent reply other threads:[~2020-12-06 18:21 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-18 14:36 [PATCH 0/6] Drivers: hv: vmbus: More VMBus-hardening changes Andrea Parri (Microsoft)
2020-11-18 14:36 ` [PATCH 1/6] Drivers: hv: vmbus: Initialize memory to be sent to the host Andrea Parri (Microsoft)
2020-12-06 16:59 ` Michael Kelley
2020-12-06 17:54 ` Andrea Parri
2020-11-18 14:36 ` [PATCH 2/6] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc() Andrea Parri (Microsoft)
2020-12-06 17:10 ` Michael Kelley
2020-12-06 18:05 ` Andrea Parri
2020-11-18 14:36 ` [PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size " Andrea Parri (Microsoft)
2020-12-06 17:14 ` Michael Kelley
2020-12-06 18:20 ` Andrea Parri [this message]
2020-11-18 14:36 ` [PATCH 4/6] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() Andrea Parri (Microsoft)
2020-11-24 16:26 ` Wei Liu
2020-11-24 19:54 ` Andrea Parri
2020-12-06 17:23 ` Michael Kelley
2020-11-18 14:36 ` [PATCH 5/6] Drivers: hv: vmbus: Resolve race condition " Andrea Parri (Microsoft)
2020-11-18 14:36 ` [PATCH 6/6] Drivers: hv: vmbus: Do not allow overwriting vmbus_connection.channels[] Andrea Parri (Microsoft)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201206182038.GC3256@andrea \
--to=parri.andrea@gmail.com \
--cc=haiyangz@microsoft.com \
--cc=juvazq@microsoft.com \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mikelley@microsoft.com \
--cc=skarade@microsoft.com \
--cc=sthemmin@microsoft.com \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.