All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
@ 2013-02-08 20:34 Tim Gardner
  2013-02-08 21:13 ` [Xen-devel] " David Vrabel
  2013-02-08 21:13   ` David Vrabel
  0 siblings, 2 replies; 5+ messages in thread
From: Tim Gardner @ 2013-02-08 20:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Tim Gardner, Konrad Rzeszutek Wilk, Jeremy Fitzhardinge,
	Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86, xen-devel,
	virtualization, stable

This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
(2.6.24).

Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: xen-devel@lists.xensource.com
Cc: virtualization@lists.linux-foundation.org
Cc: stable@vger.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---

This patch applies cleanly to 3.1.10 and newer. Requires a backport
for 2.6.24-3.2.y

 arch/x86/xen/multicalls.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 0d82003..5270407 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
 	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
 	struct callback *cb;
 
-	if (b->cbidx == MC_BATCH) {
+	if (b->cbidx >= MC_BATCH) {
 		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
 		xen_mc_flush();
+		return;
 	}
 
 	trace_xen_mc_callback(fn, data);
-- 
1.7.9.5


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [Xen-devel] [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
  2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
@ 2013-02-08 21:13   ` David Vrabel
  2013-02-08 21:13   ` David Vrabel
  1 sibling, 0 replies; 5+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
  To: Tim Gardner
  Cc: linux-kernel, Jeremy Fitzhardinge, xen-devel,
	Konrad Rzeszutek Wilk, x86, stable, virtualization, Ingo Molnar,
	H. Peter Anvin, Thomas Gleixner

On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).

There's no buffer overflow here. xen_mc_flush() resets b->cbidx.

David

>  arch/x86/xen/multicalls.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
>  	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
>  	struct callback *cb;
>  
> -	if (b->cbidx == MC_BATCH) {
> +	if (b->cbidx >= MC_BATCH) {
>  		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
>  		xen_mc_flush();
> +		return;
>  	}
>  
>  	trace_xen_mc_callback(fn, data);
> 


^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [Xen-devel] [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
  2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
@ 2013-02-08 21:13 ` David Vrabel
  2013-02-08 21:13   ` David Vrabel
  1 sibling, 0 replies; 5+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
  To: Tim Gardner
  Cc: Jeremy Fitzhardinge, xen-devel, Konrad Rzeszutek Wilk, x86,
	linux-kernel, stable, virtualization, Ingo Molnar,
	H. Peter Anvin, Thomas Gleixner

On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).

There's no buffer overflow here. xen_mc_flush() resets b->cbidx.

David

>  arch/x86/xen/multicalls.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
>  	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
>  	struct callback *cb;
>  
> -	if (b->cbidx == MC_BATCH) {
> +	if (b->cbidx >= MC_BATCH) {
>  		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
>  		xen_mc_flush();
> +		return;
>  	}
>  
>  	trace_xen_mc_callback(fn, data);
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
@ 2013-02-08 21:13   ` David Vrabel
  0 siblings, 0 replies; 5+ messages in thread
From: David Vrabel @ 2013-02-08 21:13 UTC (permalink / raw)
  To: Tim Gardner
  Cc: Jeremy Fitzhardinge, xen-devel, Konrad Rzeszutek Wilk, x86,
	linux-kernel, stable, virtualization, Ingo Molnar,
	H. Peter Anvin, Thomas Gleixner

On 08/02/2013 20:34, Tim Gardner wrote:
> This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
> (2.6.24).

There's no buffer overflow here. xen_mc_flush() resets b->cbidx.

David

>  arch/x86/xen/multicalls.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
> index 0d82003..5270407 100644
> --- a/arch/x86/xen/multicalls.c
> +++ b/arch/x86/xen/multicalls.c
> @@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
>  	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
>  	struct callback *cb;
>  
> -	if (b->cbidx == MC_BATCH) {
> +	if (b->cbidx >= MC_BATCH) {
>  		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
>  		xen_mc_flush();
> +		return;
>  	}
>  
>  	trace_xen_mc_callback(fn, data);
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow
@ 2013-02-08 20:34 Tim Gardner
  0 siblings, 0 replies; 5+ messages in thread
From: Tim Gardner @ 2013-02-08 20:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Jeremy Fitzhardinge, xen-devel, Konrad Rzeszutek Wilk, x86,
	stable, virtualization, Ingo Molnar, H. Peter Anvin,
	Thomas Gleixner, Tim Gardner

This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
(2.6.24).

Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: xen-devel@lists.xensource.com
Cc: virtualization@lists.linux-foundation.org
Cc: stable@vger.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---

This patch applies cleanly to 3.1.10 and newer. Requires a backport
for 2.6.24-3.2.y

 arch/x86/xen/multicalls.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 0d82003..5270407 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
 	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
 	struct callback *cb;
 
-	if (b->cbidx == MC_BATCH) {
+	if (b->cbidx >= MC_BATCH) {
 		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
 		xen_mc_flush();
+		return;
 	}
 
 	trace_xen_mc_callback(fn, data);
-- 
1.7.9.5

^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-02-08 22:22 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-02-08 20:34 [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow Tim Gardner
2013-02-08 21:13 ` [Xen-devel] " David Vrabel
2013-02-08 21:13 ` David Vrabel
2013-02-08 21:13   ` David Vrabel
2013-02-08 20:34 Tim Gardner

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.