* [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
@ 2013-02-08 20:34 Tim Gardner
2013-02-08 21:13 ` [Xen-devel] " David Vrabel
2013-02-08 21:13 ` David Vrabel
0 siblings, 2 replies; 4+ messages in thread
From: Tim Gardner @ 2013-02-08 20:34 UTC (permalink / raw)
To: linux-kernel
Cc: Tim Gardner, Konrad Rzeszutek Wilk, Jeremy Fitzhardinge,
Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86, xen-devel,
virtualization, stable
This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
(2.6.24).
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: xen-devel@lists.xensource.com
Cc: virtualization@lists.linux-foundation.org
Cc: stable@vger.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
This patch applies cleanly to 3.1.10 and newer. Requires a backport
for 2.6.24-3.2.y
arch/x86/xen/multicalls.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 0d82003..5270407 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
struct mc_buffer *b = &__get_cpu_var(mc_buffer);
struct callback *cb;
- if (b->cbidx == MC_BATCH) {
+ if (b->cbidx >= MC_BATCH) {
trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
xen_mc_flush();
+ return;
}
trace_xen_mc_callback(fn, data);
--
1.7.9.5
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Xen-devel] [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
@ 2013-02-08 21:13 ` David Vrabel
2013-02-08 21:13 ` David Vrabel
1 sibling, 0 replies; 4+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
To: Tim Gardner
Cc: Jeremy Fitzhardinge, xen-devel, Konrad Rzeszutek Wilk, x86,
linux-kernel, stable, virtualization, Ingo Molnar, H. Peter Anvin,
Thomas Gleixner
On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).
There's no buffer overflow here. xen_mc_flush() resets b->cbidx.
David
> arch/x86/xen/multicalls.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
> struct mc_buffer *b = &__get_cpu_var(mc_buffer);
> struct callback *cb;
>
> - if (b->cbidx == MC_BATCH) {
> + if (b->cbidx >= MC_BATCH) {
> trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
> xen_mc_flush();
> + return;
> }
>
> trace_xen_mc_callback(fn, data);
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Xen-devel] [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
@ 2013-02-08 21:13 ` David Vrabel
2013-02-08 21:13 ` David Vrabel
1 sibling, 0 replies; 4+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
To: Tim Gardner
Cc: linux-kernel, Jeremy Fitzhardinge, xen-devel,
Konrad Rzeszutek Wilk, x86, stable, virtualization, Ingo Molnar,
H. Peter Anvin, Thomas Gleixner
On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).
There's no buffer overflow here. xen_mc_flush() resets b->cbidx.
David
> arch/x86/xen/multicalls.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
> struct mc_buffer *b = &__get_cpu_var(mc_buffer);
> struct callback *cb;
>
> - if (b->cbidx == MC_BATCH) {
> + if (b->cbidx >= MC_BATCH) {
> trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
> xen_mc_flush();
> + return;
> }
>
> trace_xen_mc_callback(fn, data);
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
@ 2013-02-08 21:13 ` David Vrabel
0 siblings, 0 replies; 4+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
To: Tim Gardner
Cc: Jeremy Fitzhardinge, xen-devel, Konrad Rzeszutek Wilk, x86,
linux-kernel, stable, virtualization, Ingo Molnar, H. Peter Anvin,
Thomas Gleixner
On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).
There's no buffer overflow here. xen_mc_flush() resets b->cbidx.
David
> arch/x86/xen/multicalls.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
> struct mc_buffer *b = &__get_cpu_var(mc_buffer);
> struct callback *cb;
>
> - if (b->cbidx == MC_BATCH) {
> + if (b->cbidx >= MC_BATCH) {
> trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
> xen_mc_flush();
> + return;
> }
>
> trace_xen_mc_callback(fn, data);
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-02-08 22:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
2013-02-08 21:13 ` [Xen-devel] " David Vrabel
2013-02-08 21:13 ` David Vrabel
2013-02-08 21:13 ` David Vrabel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.