From: Paolo Abeni <pabeni@redhat.com>
To: Cezar Bulinaru <cbulinaru@gmail.com>,
kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org,
decui@microsoft.com, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, linux-hyperv@vger.kernel.org,
netdev@vger.kernel.org
Subject: Re: [PATCH v2] hv_netvsc: Fix a warning triggered by memcpy in rndis_filter
Date: Thu, 13 Oct 2022 10:56:27 +0200 [thread overview]
Message-ID: <e71426117517a62f4e940318b1c048f15d8fe5b7.camel@redhat.com> (raw)
In-Reply-To: <20221012013922.32374-1-cbulinaru@gmail.com>
Hello,
On Tue, 2022-10-11 at 21:39 -0400, Cezar Bulinaru wrote:
> A warning is triggered when the response message len exceeds
> the size of rndis_message. Inside the rndis_request structure
> these fields are however followed by a RNDIS_EXT_LEN padding
> so it is safe to use unsafe_memcpy.
>
> memcpy: detected field-spanning write (size 168) of single field "(void *)&request->response_msg + (sizeof(struct rndis_message) - sizeof(union rndis_message_container)) + sizeof(*req_id)" at drivers/net/hyperv/rndis_filter.c:338 (size 40)
> RSP: 0018:ffffc90000144de0 EFLAGS: 00010282
> RAX: 0000000000000000 RBX: ffff8881766b4000 RCX: 0000000000000000
> RDX: 0000000000000102 RSI: 0000000000009ffb RDI: 00000000ffffffff
> RBP: ffffc90000144e38 R08: 0000000000000000 R09: 00000000ffffdfff
> R10: ffffc90000144c48 R11: ffffffff82f56ac8 R12: ffff8881766b403c
> R13: 00000000000000a8 R14: ffff888100b75000 R15: ffff888179301d00
> FS: 0000000000000000(0000) GS:ffff8884d6280000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055f8b024c418 CR3: 0000000176548001 CR4: 00000000003706e0
> Call Trace:
> <IRQ>
> ? _raw_spin_unlock_irqrestore+0x27/0x50
> netvsc_poll+0x556/0x940 [hv_netvsc]
> __napi_poll+0x2e/0x170
> net_rx_action+0x299/0x2f0
> __do_softirq+0xed/0x2ef
> __irq_exit_rcu+0x9f/0x110
> irq_exit_rcu+0xe/0x20
> sysvec_hyperv_callback+0xb0/0xd0
> </IRQ>
> <TASK>
> asm_sysvec_hyperv_callback+0x1b/0x20
> RIP: 0010:native_safe_halt+0xb/0x10
>
> Signed-off-by: Cezar Bulinaru <cbulinaru@gmail.com>
Could you please additionally provide a suitable 'Fixes' tag?
You need to repost a new version, including such tag just before your
SoB. While at that, please also include the target tree in the subj
prefix (net).
On this repost you can retain the ack/review tags collected so far.
Thanks,
Paolo
next prev parent reply other threads:[~2022-10-13 8:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-12 1:39 [PATCH v2] hv_netvsc: Fix a warning triggered by memcpy in rndis_filter Cezar Bulinaru
2022-10-12 1:56 ` Michael Kelley (LINUX)
2022-10-13 8:56 ` Paolo Abeni [this message]
2022-10-14 2:46 ` Cezar Bulinaru
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e71426117517a62f4e940318b1c048f15d8fe5b7.camel@redhat.com \
--to=pabeni@redhat.com \
--cc=cbulinaru@gmail.com \
--cc=davem@davemloft.net \
--cc=decui@microsoft.com \
--cc=edumazet@google.com \
--cc=haiyangz@microsoft.com \
--cc=kuba@kernel.org \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).