From: Wei Liu <wei.liu@kernel.org>
To: Andrea Parri <parri.andrea@gmail.com>
Cc: Wei Liu <wei.liu@kernel.org>,
linux-kernel@vger.kernel.org, linux-hyperv@vger.kernel.org,
"K . Y . Srinivasan" <kys@microsoft.com>,
Haiyang Zhang <haiyangz@microsoft.com>,
Stephen Hemminger <sthemmin@microsoft.com>,
Michael Kelley <mikelley@microsoft.com>,
Juan Vazquez <juvazq@microsoft.com>,
Saruhan Karademir <skarade@microsoft.com>
Subject: Re: [PATCH v2 2/7] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()
Date: Wed, 2 Dec 2020 13:40:04 +0000 [thread overview]
Message-ID: <20201202134004.5tgrbyijrhvwwmk2@liuwe-devbox-debian-v2> (raw)
In-Reply-To: <20201202133716.GA22763@andrea>
On Wed, Dec 02, 2020 at 02:37:16PM +0100, Andrea Parri wrote:
> > > @@ -1072,12 +1073,19 @@ void vmbus_on_msg_dpc(unsigned long data)
> > > /* no msg */
> > > return;
> > >
> > > + /*
> > > + * The hv_message object is in memory shared with the host. The host
> > > + * could erroneously or maliciously modify such object. Make sure to
> > > + * validate its fields and avoid double fetches whenever feasible.
> > > + */
> > > +
> > > hdr = (struct vmbus_channel_message_header *)msg->u.payload;
> > > + msgtype = hdr->msgtype;
> >
> > Should READ_ONCE be used here?
>
> I think it should. Thank you for pointing this out.
Glad I can help.
The same comment applies to other patches as well, of course.
Wei.
>
> Andrea
next prev parent reply other threads:[~2020-12-02 13:41 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-02 9:22 [PATCH v2 0/7] Drivers: hv: vmbus: More VMBus-hardening changes Andrea Parri (Microsoft)
2020-12-02 9:22 ` [PATCH v2 1/7] Drivers: hv: vmbus: Initialize memory to be sent to the host Andrea Parri (Microsoft)
2020-12-02 9:22 ` [PATCH v2 2/7] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc() Andrea Parri (Microsoft)
2020-12-02 12:22 ` Wei Liu
2020-12-02 13:37 ` Andrea Parri
2020-12-02 13:40 ` Wei Liu [this message]
2020-12-02 14:14 ` Andrea Parri
2020-12-02 9:22 ` [PATCH v2 3/7] Drivers: hv: vmbus: Avoid double fetch of payload_size " Andrea Parri (Microsoft)
2020-12-02 9:22 ` [PATCH v2 4/7] Drivers: hv: vmbus: Copy the hv_message object " Andrea Parri (Microsoft)
2020-12-06 18:39 ` Michael Kelley
2020-12-06 21:33 ` Andrea Parri
2020-12-02 9:22 ` [PATCH v2 5/7] Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() Andrea Parri (Microsoft)
2020-12-02 9:22 ` [PATCH v2 6/7] Drivers: hv: vmbus: Resolve race condition " Andrea Parri (Microsoft)
2020-12-02 9:22 ` [PATCH v2 7/7] Drivers: hv: vmbus: Do not allow overwriting vmbus_connection.channels[] Andrea Parri (Microsoft)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201202134004.5tgrbyijrhvwwmk2@liuwe-devbox-debian-v2 \
--to=wei.liu@kernel.org \
--cc=haiyangz@microsoft.com \
--cc=juvazq@microsoft.com \
--cc=kys@microsoft.com \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mikelley@microsoft.com \
--cc=parri.andrea@gmail.com \
--cc=skarade@microsoft.com \
--cc=sthemmin@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.