All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
	Xie Yongji <xieyongji@bytedance.com>,
	virtualization@lists.linux-foundation.org,
	"Michael S . Tsirkin" <mst@redhat.com>
Subject: [PATCH AUTOSEL 5.10 36/37] virtio_console: Assure used length from device is limited
Date: Sat, 10 Jul 2021 19:50:14 -0400	[thread overview]
Message-ID: <20210710235016.3221124-36-sashal@kernel.org> (raw)
In-Reply-To: <20210710235016.3221124-1-sashal@kernel.org>

From: Xie Yongji <xieyongji@bytedance.com>

[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ]

The buf->len might come from an untrusted device. This
ensures the value would not exceed the size of the buffer
to avoid data corruption or loss.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/virtio_console.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 1836cc56e357..673522874cec 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -475,7 +475,7 @@ static struct port_buffer *get_inbuf(struct port *port)
 
 	buf = virtqueue_get_buf(port->in_vq, &len);
 	if (buf) {
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 		port->stats.bytes_received += len;
 	}
@@ -1712,7 +1712,7 @@ static void control_work_handler(struct work_struct *work)
 	while ((buf = virtqueue_get_buf(vq, &len))) {
 		spin_unlock(&portdev->c_ivq_lock);
 
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 
 		handle_control_message(vq->vdev, portdev, buf);
-- 
2.30.2

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization

WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xie Yongji <xieyongji@bytedance.com>,
	Jason Wang <jasowang@redhat.com>,
	"Michael S . Tsirkin" <mst@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	virtualization@lists.linux-foundation.org
Subject: [PATCH AUTOSEL 5.10 36/37] virtio_console: Assure used length from device is limited
Date: Sat, 10 Jul 2021 19:50:14 -0400	[thread overview]
Message-ID: <20210710235016.3221124-36-sashal@kernel.org> (raw)
In-Reply-To: <20210710235016.3221124-1-sashal@kernel.org>

From: Xie Yongji <xieyongji@bytedance.com>

[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ]

The buf->len might come from an untrusted device. This
ensures the value would not exceed the size of the buffer
to avoid data corruption or loss.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/virtio_console.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 1836cc56e357..673522874cec 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -475,7 +475,7 @@ static struct port_buffer *get_inbuf(struct port *port)
 
 	buf = virtqueue_get_buf(port->in_vq, &len);
 	if (buf) {
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 		port->stats.bytes_received += len;
 	}
@@ -1712,7 +1712,7 @@ static void control_work_handler(struct work_struct *work)
 	while ((buf = virtqueue_get_buf(vq, &len))) {
 		spin_unlock(&portdev->c_ivq_lock);
 
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 
 		handle_control_message(vq->vdev, portdev, buf);
-- 
2.30.2


  parent reply	other threads:[~2021-07-10 23:51 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-10 23:49 [PATCH AUTOSEL 5.10 01/37] power: supply: sc27xx: Add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 02/37] power: supply: sc2731_charger: " Sasha Levin
2021-07-10 23:49 ` [f2fs-dev] [PATCH AUTOSEL 5.10 03/37] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances Sasha Levin
2021-07-10 23:49   ` Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 04/37] pwm: spear: Don't modify HW state in .remove callback Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 05/37] PCI: ftpci100: Rename macro name collision Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 06/37] power: supply: ab8500: Avoid NULL pointers Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 07/37] PCI: hv: Fix a race condition when removing the device Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 08/37] power: supply: max17042: Do not enforce (incorrect) interrupt trigger type Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 09/37] power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 10/37] ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1 Sasha Levin
2021-07-10 23:49   ` Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 11/37] PCI/P2PDMA: Avoid pci_get_slot(), which may sleep Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 12/37] NFSv4: Fix delegation return in cases where we have to retry Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 13/37] PCI: pciehp: Ignore Link Down/Up caused by DPC Sasha Levin
2021-07-10 23:49   ` Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 14/37] watchdog: Fix possible use-after-free in wdt_startup() Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 15/37] watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 16/37] watchdog: Fix possible use-after-free by calling del_timer_sync() Sasha Levin
2021-07-10 23:49   ` Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 17/37] watchdog: imx_sc_wdt: fix pretimeout Sasha Levin
2021-07-10 23:49   ` Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 18/37] watchdog: iTCO_wdt: Account for rebooting on second timeout Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 19/37] x86/fpu: Return proper error codes from user access functions Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 20/37] remoteproc: core: Fix cdev remove and rproc del Sasha Levin
2021-07-10 23:49 ` [PATCH AUTOSEL 5.10 21/37] PCI: tegra: Add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 22/37] orangefs: fix orangefs df output Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 23/37] ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 24/37] drm/gma500: Add the missed drm_gem_object_put() in psb_user_framebuffer_create() Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 25/37] NFS: nfs_find_open_context() may only select open files Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 26/37] power: supply: charger-manager: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 27/37] power: supply: ab8500: " Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 28/37] drm/amdkfd: fix sysfs kobj leak Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 29/37] pwm: img: Fix PM reference leak in img_pwm_enable() Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 30/37] pwm: tegra: Don't modify HW state in .remove callback Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 31/37] ACPI: AMBA: Fix resource name in /proc/iomem Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 32/37] ACPI: video: Add quirk for the Dell Vostro 3350 Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 33/37] PCI: rockchip: Register IRQ handlers after device and data are ready Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 34/37] virtio-blk: Fix memory leak among suspend/resume procedure Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 35/37] virtio_net: Fix error handling in virtnet_restore() Sasha Levin
2021-07-10 23:50   ` Sasha Levin
2021-07-10 23:50 ` Sasha Levin [this message]
2021-07-10 23:50   ` [PATCH AUTOSEL 5.10 36/37] virtio_console: Assure used length from device is limited Sasha Levin
2021-07-10 23:50 ` [PATCH AUTOSEL 5.10 37/37] virtio: fix up virtio_disable_cb Sasha Levin
2021-07-10 23:50   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210710235016.3221124-36-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=virtualization@lists.linux-foundation.org \
    --cc=xieyongji@bytedance.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.