From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Ian Campbell <ian.campbell@citrix.com>,
Haogang Chen <haogangchen@gmail.com>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Subject: [09/27] xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.
Date: Mon, 23 Jan 2012 15:40:55 -0800 [thread overview]
Message-ID: <20120123234202.444992101@clark.kroah.org> (raw)
In-Reply-To: <20120123234224.GA19510@kroah.com>
2.6.32-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Ian Campbell <Ian.Campbell@citrix.com>
commit 9e7860cee18241633eddb36a4c34c7b61d8cecbc upstream.
Haogang Chen found out that:
There is a potential integer overflow in process_msg() that could result
in cross-domain attack.
body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
call to xb_read() would write to a zero-length buffer.
The other end of this connection is always the xenstore backend daemon
so there is no guest (malicious or otherwise) which can do this. The
xenstore daemon is a trusted component in the system.
However this seem like a reasonable robustness improvement so we should
have it.
And Ian when read the API docs found that:
The payload length (len field of the header) is limited to 4096
(XENSTORE_PAYLOAD_MAX) in both directions. If a client exceeds the
limit, its xenstored connection will be immediately killed by
xenstored, which is usually catastrophic from the client's point of
view. Clients (particularly domains, which cannot just reconnect)
should avoid this.
so this patch checks against that instead.
This also avoids a potential integer overflow pointed out by Haogang Chen.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/xen/xenbus/xenbus_xs.c | 6 ++++++
include/xen/interface/io/xs_wire.h | 3 +++
2 files changed, 9 insertions(+)
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -766,6 +766,12 @@ static int process_msg(void)
goto out;
}
+ if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
+ kfree(msg);
+ err = -EINVAL;
+ goto out;
+ }
+
body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
if (body == NULL) {
kfree(msg);
--- a/include/xen/interface/io/xs_wire.h
+++ b/include/xen/interface/io/xs_wire.h
@@ -84,4 +84,7 @@ struct xenstore_domain_interface {
XENSTORE_RING_IDX rsp_cons, rsp_prod;
};
+/* Violating this is very bad. See docs/misc/xenstore.txt. */
+#define XENSTORE_PAYLOAD_MAX 4096
+
#endif /* _XS_WIRE_H */
next prev parent reply other threads:[~2012-01-23 23:45 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-23 23:42 [00/27] 2.6.32.55-longterm review Greg KH
2012-01-23 23:40 ` [01/27] ext4: fix undefined behavior in ext4_fill_flex_info() Greg KH
2012-01-23 23:40 ` [02/27] ALSA: snd-usb-us122l: Delete calls to preempt_disable Greg KH
2012-01-23 23:40 ` [03/27] ALSA: ice1724 - Check for ac97 to avoid kernel oops Greg KH
2012-01-23 23:40 ` [04/27] ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs Greg KH
2012-01-23 23:40 ` [05/27] HID: bump maximum global item tag report size to 96 bytes Greg KH
2012-01-23 23:40 ` [06/27] UBI: fix use-after-free on error path Greg KH
2012-01-23 23:40 ` [07/27] PCI: Fix PCI_EXP_TYPE_RC_EC value Greg KH
2012-01-23 23:40 ` [08/27] PCI: msi: Disable msi interrupts when we initialize a pci device Greg KH
2012-01-23 23:40 ` Greg KH [this message]
2012-01-23 23:40 ` [10/27] ima: free duplicate measurement memory Greg KH
2012-01-23 23:40 ` [11/27] PNP: work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB Greg KH
2012-01-23 23:40 ` [12/27] x86: Fix mmap random address range Greg KH
2012-01-23 23:40 ` [13/27] UBI: fix nameless volumes handling Greg KH
2012-01-23 23:41 ` [14/27] i2c: Fix error value returned by several bus drivers Greg KH
2012-01-23 23:41 ` [15/27] [media] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy() Greg KH
2012-01-23 23:41 ` [16/27] svcrpc: fix double-free on shutdown of nfsd after changing pool mode Greg KH
2012-01-23 23:41 ` [17/27] svcrpc: destroy server sockets all at once Greg KH
2012-01-23 23:41 ` [18/27] nfsd: Fix oops when parsing a 0 length export Greg KH
2012-01-23 23:41 ` [19/27] USB: cdc-wdm: fix misuse of logical operation in place of bitop Greg KH
2012-01-23 23:41 ` [20/27] [S390] fix cputime overflow in uptime_proc_show Greg KH
2012-01-23 23:41 ` [21/27] USB: Fix bad dma problem on WDM device disconnect Greg KH
2012-01-23 23:41 ` [22/27] block: add and use scsi_blk_cmd_ioctl Greg KH
2012-01-23 23:41 ` [23/27] kernel.h: add printk_ratelimited and pr_<level>_rl Greg KH
2012-01-24 14:46 ` Phil Carmody
2012-01-24 16:35 ` Ben Hutchings
2012-01-24 16:43 ` Greg KH
2012-01-23 23:41 ` [24/27] ALSA: HDA: Fix internal microphone on Dell Studio 16 XPS 1645 Greg KH
2012-01-23 23:41 ` [25/27] [SCSI] sym53c8xx: Fix NULL pointer dereference in slave_destroy Greg KH
2012-01-23 23:41 ` [26/27] score: fix off-by-one index into syscall table Greg KH
2012-01-23 23:41 ` [27/27] kprobes: initialize before using a hlist Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120123234202.444992101@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=haogangchen@gmail.com \
--cc=ian.campbell@citrix.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox