* [PATCH] virtio_console: fix a crash in config_work_handler
@ 2017-01-14 10:38 G. Campana
2017-01-16 3:35 ` Amit Shah
0 siblings, 1 reply; 5+ messages in thread
From: G. Campana @ 2017-01-14 10:38 UTC (permalink / raw)
To: Amit Shah; +Cc: linux-kernel, G. Campana
Using control_work instead of config_work as the 3rd argument to
container_of results in an invalid portdev pointer. Indeed, the work
structure is initialized as below:
INIT_WORK(&portdev->config_work, &config_work_handler);
It leads to a crash when portdev->vdev is dereferenced later. This bug
is triggered when the guest uses a virtio-console without multiport
feature and receives a config_changed virtio interrupt.
---
drivers/char/virtio_console.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 8b00e79..17857be 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1862,7 +1862,7 @@ static void config_work_handler(struct work_struct *work)
{
struct ports_device *portdev;
- portdev = container_of(work, struct ports_device, control_work);
+ portdev = container_of(work, struct ports_device, config_work);
if (!use_multiport(portdev)) {
struct virtio_device *vdev;
struct port *port;
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] virtio_console: fix a crash in config_work_handler
2017-01-14 10:38 [PATCH] virtio_console: fix a crash in config_work_handler G. Campana
@ 2017-01-16 3:35 ` Amit Shah
2017-01-16 9:45 ` [PATCH v2] " G. Campana
0 siblings, 1 reply; 5+ messages in thread
From: Amit Shah @ 2017-01-16 3:35 UTC (permalink / raw)
To: G. Campana; +Cc: linux-kernel
On (Sat) 14 Jan 2017 [11:38:39], G. Campana wrote:
> Using control_work instead of config_work as the 3rd argument to
> container_of results in an invalid portdev pointer. Indeed, the work
> structure is initialized as below:
>
> INIT_WORK(&portdev->config_work, &config_work_handler);
>
> It leads to a crash when portdev->vdev is dereferenced later. This bug
> is triggered when the guest uses a virtio-console without multiport
> feature and receives a config_changed virtio interrupt.
Thanks, the patch is fine, but needs signed-off-by.
Please also post to virtualization@lists.linux-foundation.org
Amit
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] virtio_console: fix a crash in config_work_handler
2017-01-16 3:35 ` Amit Shah
@ 2017-01-16 9:45 ` G. Campana
2017-01-16 10:27 ` Amit Shah
0 siblings, 1 reply; 5+ messages in thread
From: G. Campana @ 2017-01-16 9:45 UTC (permalink / raw)
To: Amit Shah; +Cc: virtualization, linux-kernel, G. Campana
Using control_work instead of config_work as the 3rd argument to
container_of results in an invalid portdev pointer. Indeed, the work
structure is initialized as below:
INIT_WORK(&portdev->config_work, &config_work_handler);
It leads to a crash when portdev->vdev is dereferenced later. This bug
is triggered when the guest uses a virtio-console without multiport
feature and receives a config_changed virtio interrupt.
Signed-off-by: G. Campana <gcampana@quarkslab.com>
---
drivers/char/virtio_console.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 8b00e79..17857be 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1862,7 +1862,7 @@ static void config_work_handler(struct work_struct *work)
{
struct ports_device *portdev;
- portdev = container_of(work, struct ports_device, control_work);
+ portdev = container_of(work, struct ports_device, config_work);
if (!use_multiport(portdev)) {
struct virtio_device *vdev;
struct port *port;
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] virtio_console: fix a crash in config_work_handler
2017-01-16 9:45 ` [PATCH v2] " G. Campana
@ 2017-01-16 10:27 ` Amit Shah
2017-01-16 13:30 ` Michael S. Tsirkin
0 siblings, 1 reply; 5+ messages in thread
From: Amit Shah @ 2017-01-16 10:27 UTC (permalink / raw)
To: G. Campana; +Cc: virtualization, linux-kernel, Michael S. Tsirkin
On (Mon) 16 Jan 2017 [10:45:02], G. Campana wrote:
> Using control_work instead of config_work as the 3rd argument to
> container_of results in an invalid portdev pointer. Indeed, the work
> structure is initialized as below:
>
> INIT_WORK(&portdev->config_work, &config_work_handler);
>
> It leads to a crash when portdev->vdev is dereferenced later. This bug
> is triggered when the guest uses a virtio-console without multiport
> feature and receives a config_changed virtio interrupt.
>
> Signed-off-by: G. Campana <gcampana@quarkslab.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Michael, can you please pick this up?
Amit
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] virtio_console: fix a crash in config_work_handler
2017-01-16 10:27 ` Amit Shah
@ 2017-01-16 13:30 ` Michael S. Tsirkin
0 siblings, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2017-01-16 13:30 UTC (permalink / raw)
To: Amit Shah; +Cc: G. Campana, virtualization, linux-kernel
On Mon, Jan 16, 2017 at 03:57:23PM +0530, Amit Shah wrote:
> On (Mon) 16 Jan 2017 [10:45:02], G. Campana wrote:
> > Using control_work instead of config_work as the 3rd argument to
> > container_of results in an invalid portdev pointer. Indeed, the work
> > structure is initialized as below:
> >
> > INIT_WORK(&portdev->config_work, &config_work_handler);
> >
> > It leads to a crash when portdev->vdev is dereferenced later. This bug
> > is triggered when the guest uses a virtio-console without multiport
> > feature and receives a config_changed virtio interrupt.
> >
> > Signed-off-by: G. Campana <gcampana@quarkslab.com>
>
> Reviewed-by: Amit Shah <amit.shah@redhat.com>
>
> Michael, can you please pick this up?
>
> Amit
Sure.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-01-16 13:31 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-14 10:38 [PATCH] virtio_console: fix a crash in config_work_handler G. Campana
2017-01-16 3:35 ` Amit Shah
2017-01-16 9:45 ` [PATCH v2] " G. Campana
2017-01-16 10:27 ` Amit Shah
2017-01-16 13:30 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox