From: Stefano Garzarella <sgarzare@redhat.com>
To: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Cc: Vishnu Dasa <vdasa@vmware.com>,
lvc-project@linuxtesting.org,
VMware PV-Drivers Reviewers <pv-drivers@vmware.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
virtualization@lists.linux-foundation.org,
Bryan Tan <bryantan@vmware.com>, Jakub Kicinski <kuba@kernel.org>
Subject: Re: [PATCH v2] net: vmw_vsock: vmci: Check memcpy_from_msg()
Date: Mon, 5 Dec 2022 10:47:36 +0100 [thread overview]
Message-ID: <20221205094736.k3yuwk7emijpitvw@sgarzare-redhat> (raw)
In-Reply-To: <20221203083312.923029-1-artem.chernyshev@red-soft.ru>
On Sat, Dec 03, 2022 at 11:33:12AM +0300, Artem Chernyshev wrote:
>vmci_transport_dgram_enqueue() does not check the return value
>of memcpy_from_msg(). Return with an error if the memcpy fails.
>
>Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
>Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr")
>Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
>---
>V1->V2 Fix memory leaking and updates for description
>
> net/vmw_vsock/vmci_transport.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
>index 842c94286d31..c94c3deaa09d 100644
>--- a/net/vmw_vsock/vmci_transport.c
>+++ b/net/vmw_vsock/vmci_transport.c
>@@ -1711,7 +1711,10 @@ static int vmci_transport_dgram_enqueue(
> if (!dg)
> return -ENOMEM;
>
>- memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len);
>+ if (memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len)) {
>+ kfree(dg);
>+ return -EFAULT;
Since memcpy_from_msg() is a wrapper of copy_from_iter_full() that
simply returns -EFAULT in case of an error, perhaps it would be better
here to return the value of memcpy_from_msg() instead of wiring the
error.
However in the end the behavior is the same, so even if you don't want
to change it I'll leave my R-b:
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Thanks,
Stefano
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
WARNING: multiple messages have this Message-ID (diff)
From: Stefano Garzarella <sgarzare@redhat.com>
To: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Cc: Vishnu Dasa <vdasa@vmware.com>, Bryan Tan <bryantan@vmware.com>,
VMware PV-Drivers Reviewers <pv-drivers@vmware.com>,
Jakub Kicinski <kuba@kernel.org>,
linux-kernel@vger.kernel.org,
virtualization@lists.linux-foundation.org,
netdev@vger.kernel.org, lvc-project@linuxtesting.org
Subject: Re: [PATCH v2] net: vmw_vsock: vmci: Check memcpy_from_msg()
Date: Mon, 5 Dec 2022 10:47:36 +0100 [thread overview]
Message-ID: <20221205094736.k3yuwk7emijpitvw@sgarzare-redhat> (raw)
In-Reply-To: <20221203083312.923029-1-artem.chernyshev@red-soft.ru>
On Sat, Dec 03, 2022 at 11:33:12AM +0300, Artem Chernyshev wrote:
>vmci_transport_dgram_enqueue() does not check the return value
>of memcpy_from_msg(). Return with an error if the memcpy fails.
>
>Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
>Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr")
>Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
>---
>V1->V2 Fix memory leaking and updates for description
>
> net/vmw_vsock/vmci_transport.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
>index 842c94286d31..c94c3deaa09d 100644
>--- a/net/vmw_vsock/vmci_transport.c
>+++ b/net/vmw_vsock/vmci_transport.c
>@@ -1711,7 +1711,10 @@ static int vmci_transport_dgram_enqueue(
> if (!dg)
> return -ENOMEM;
>
>- memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len);
>+ if (memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len)) {
>+ kfree(dg);
>+ return -EFAULT;
Since memcpy_from_msg() is a wrapper of copy_from_iter_full() that
simply returns -EFAULT in case of an error, perhaps it would be better
here to return the value of memcpy_from_msg() instead of wiring the
error.
However in the end the behavior is the same, so even if you don't want
to change it I'll leave my R-b:
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Thanks,
Stefano
next prev parent reply other threads:[~2022-12-05 9:47 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-02 22:58 [PATCH] net: vmw_vsock: vmci: Check memcpy_from_msg() Artem Chernyshev
2022-12-03 1:17 ` Vishnu Dasa
2022-12-03 1:17 ` Vishnu Dasa via Virtualization
2022-12-03 7:56 ` Artem Chernyshev
2022-12-03 8:33 ` [PATCH v2] " Artem Chernyshev
2022-12-05 9:47 ` Stefano Garzarella [this message]
2022-12-05 9:47 ` Stefano Garzarella
2022-12-05 11:22 ` Artem Chernyshev
2022-12-05 11:52 ` [PATCH v3] " Artem Chernyshev
2022-12-05 13:06 ` Stefano Garzarella
2022-12-05 13:06 ` Stefano Garzarella
2022-12-05 23:03 ` Vishnu Dasa
2022-12-05 23:03 ` Vishnu Dasa via Virtualization
2022-12-06 6:52 ` Artem Chernyshev
2022-12-06 6:58 ` [PATCH v4] " Artem Chernyshev
2022-12-09 8:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221205094736.k3yuwk7emijpitvw@sgarzare-redhat \
--to=sgarzare@redhat.com \
--cc=artem.chernyshev@red-soft.ru \
--cc=bryantan@vmware.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=netdev@vger.kernel.org \
--cc=pv-drivers@vmware.com \
--cc=vdasa@vmware.com \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.