* [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address()
@ 2016-12-06 2:10 Andy Lutomirski
2016-12-06 2:30 ` Jason Wang
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Andy Lutomirski @ 2016-12-06 2:10 UTC (permalink / raw)
To: netdev
Cc: Michael S . Tsirkin, linux-kernel, virtualization,
Andy Lutomirski, Laura Abbott
With CONFIG_VMAP_STACK=y, virtnet_set_mac_address() can be passed a
pointer to the stack and it will OOPS. Copy the address to the heap
to prevent the crash.
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Laura Abbott <labbott@redhat.com>
Reported-by: zbyszek@in.waw.pl
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
Very lightly tested.
drivers/net/virtio_net.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7276d5a95bd0..cbf1c613c67a 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
struct virtnet_info *vi = netdev_priv(dev);
struct virtio_device *vdev = vi->vdev;
int ret;
- struct sockaddr *addr = p;
+ struct sockaddr *addr;
struct scatterlist sg;
- ret = eth_prepare_mac_addr_change(dev, p);
+ addr = kmalloc(sizeof(*addr), GFP_KERNEL);
+ if (!addr)
+ return -ENOMEM;
+ memcpy(addr, p, sizeof(*addr));
+
+ ret = eth_prepare_mac_addr_change(dev, addr);
if (ret)
- return ret;
+ goto out;
if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
sg_init_one(&sg, addr->sa_data, dev->addr_len);
@@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
dev_warn(&vdev->dev,
"Failed to set mac address by vq command.\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto out;
}
} else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
!virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
@@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
}
eth_commit_mac_addr_change(dev, p);
+ ret = 0;
- return 0;
+out:
+ kfree(addr);
+ return ret;
}
static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
--
2.9.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address()
2016-12-06 2:10 [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address() Andy Lutomirski
@ 2016-12-06 2:30 ` Jason Wang
2016-12-06 3:00 ` Michael S. Tsirkin
2016-12-06 16:39 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Jason Wang @ 2016-12-06 2:30 UTC (permalink / raw)
To: Andy Lutomirski, netdev
Cc: Laura Abbott, Michael S . Tsirkin, linux-kernel, virtualization
On 2016年12月06日 10:10, Andy Lutomirski wrote:
> With CONFIG_VMAP_STACK=y, virtnet_set_mac_address() can be passed a
> pointer to the stack and it will OOPS. Copy the address to the heap
> to prevent the crash.
>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Jason Wang <jasowang@redhat.com>
> Cc: Laura Abbott <labbott@redhat.com>
> Reported-by: zbyszek@in.waw.pl
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
>
> Very lightly tested.
>
> drivers/net/virtio_net.c | 19 ++++++++++++++-----
> 1 file changed, 14 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 7276d5a95bd0..cbf1c613c67a 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> struct virtnet_info *vi = netdev_priv(dev);
> struct virtio_device *vdev = vi->vdev;
> int ret;
> - struct sockaddr *addr = p;
> + struct sockaddr *addr;
> struct scatterlist sg;
>
> - ret = eth_prepare_mac_addr_change(dev, p);
> + addr = kmalloc(sizeof(*addr), GFP_KERNEL);
> + if (!addr)
> + return -ENOMEM;
> + memcpy(addr, p, sizeof(*addr));
> +
> + ret = eth_prepare_mac_addr_change(dev, addr);
> if (ret)
> - return ret;
> + goto out;
>
> if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
> sg_init_one(&sg, addr->sa_data, dev->addr_len);
> @@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
> dev_warn(&vdev->dev,
> "Failed to set mac address by vq command.\n");
> - return -EINVAL;
> + ret = -EINVAL;
> + goto out;
> }
> } else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
> !virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
> @@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> }
>
> eth_commit_mac_addr_change(dev, p);
> + ret = 0;
>
> - return 0;
> +out:
> + kfree(addr);
> + return ret;
> }
>
> static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
Acked-by: Jason Wang <jasowang@redhat.com>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address()
2016-12-06 2:10 [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address() Andy Lutomirski
2016-12-06 2:30 ` Jason Wang
@ 2016-12-06 3:00 ` Michael S. Tsirkin
2016-12-06 16:39 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Michael S. Tsirkin @ 2016-12-06 3:00 UTC (permalink / raw)
To: Andy Lutomirski
Cc: netdev, linux-kernel, virtualization, Jason Wang, Laura Abbott
On Mon, Dec 05, 2016 at 06:10:58PM -0800, Andy Lutomirski wrote:
> With CONFIG_VMAP_STACK=y, virtnet_set_mac_address() can be passed a
> pointer to the stack and it will OOPS. Copy the address to the heap
> to prevent the crash.
>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Jason Wang <jasowang@redhat.com>
> Cc: Laura Abbott <labbott@redhat.com>
> Reported-by: zbyszek@in.waw.pl
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>
> Very lightly tested.
>
> drivers/net/virtio_net.c | 19 ++++++++++++++-----
> 1 file changed, 14 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 7276d5a95bd0..cbf1c613c67a 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> struct virtnet_info *vi = netdev_priv(dev);
> struct virtio_device *vdev = vi->vdev;
> int ret;
> - struct sockaddr *addr = p;
> + struct sockaddr *addr;
> struct scatterlist sg;
>
> - ret = eth_prepare_mac_addr_change(dev, p);
> + addr = kmalloc(sizeof(*addr), GFP_KERNEL);
> + if (!addr)
> + return -ENOMEM;
> + memcpy(addr, p, sizeof(*addr));
> +
> + ret = eth_prepare_mac_addr_change(dev, addr);
> if (ret)
> - return ret;
> + goto out;
>
> if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
> sg_init_one(&sg, addr->sa_data, dev->addr_len);
> @@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
> dev_warn(&vdev->dev,
> "Failed to set mac address by vq command.\n");
> - return -EINVAL;
> + ret = -EINVAL;
> + goto out;
> }
> } else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
> !virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
> @@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
> }
>
> eth_commit_mac_addr_change(dev, p);
> + ret = 0;
>
> - return 0;
> +out:
> + kfree(addr);
> + return ret;
> }
>
> static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
> --
> 2.9.3
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address()
2016-12-06 2:10 [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address() Andy Lutomirski
2016-12-06 2:30 ` Jason Wang
2016-12-06 3:00 ` Michael S. Tsirkin
@ 2016-12-06 16:39 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2016-12-06 16:39 UTC (permalink / raw)
To: luto; +Cc: netdev, linux-kernel, virtualization, mst, jasowang, labbott
From: Andy Lutomirski <luto@kernel.org>
Date: Mon, 5 Dec 2016 18:10:58 -0800
> With CONFIG_VMAP_STACK=y, virtnet_set_mac_address() can be passed a
> pointer to the stack and it will OOPS. Copy the address to the heap
> to prevent the crash.
>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Jason Wang <jasowang@redhat.com>
> Cc: Laura Abbott <labbott@redhat.com>
> Reported-by: zbyszek@in.waw.pl
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-12-06 16:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-06 2:10 [PATCH] virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address() Andy Lutomirski
2016-12-06 2:30 ` Jason Wang
2016-12-06 3:00 ` Michael S. Tsirkin
2016-12-06 16:39 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).