From: "Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>
To: xen-devel@lists.xenproject.org
Cc: "Juergen Gross" <jgross@suse.com>,
"open list:NETWORKING DRIVERS" <netdev@vger.kernel.org>,
"Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>,
stable@vger.kernel.org,
"open list" <linux-kernel@vger.kernel.org>,
"Boris Ostrovsky" <boris.ostrovsky@oracle.com>
Subject: [PATCH 4/6] xen-netfront: add range check for Tx response id
Date: Mon, 30 Apr 2018 23:01:48 +0200 [thread overview]
Message-ID: <960c6d6300fd3450ae9fb1de1c412bef7dbae992.1525122026.git-series.marmarek__14164.3024435782$1525122106$gmane$org@invisiblethingslab.com> (raw)
In-Reply-To: <cover.7ee732ab822b728ec486a3118ec12e9c06f0f325.1525122026.git-series.marmarek@invisiblethingslab.com>
In-Reply-To: <cover.7ee732ab822b728ec486a3118ec12e9c06f0f325.1525122026.git-series.marmarek@invisiblethingslab.com>
Tx response ID is fetched from shared page, so make sure it is sane
before using it as an array index.
CC: stable@vger.kernel.org
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
drivers/net/xen-netfront.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 934b8a4..55c9b25 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -394,6 +394,7 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
continue;
id = txrsp.id;
+ BUG_ON(id >= NET_TX_RING_SIZE);
skb = queue->tx_skbs[id].skb;
if (unlikely(gnttab_query_foreign_access(
queue->grant_tx_ref[id]) != 0)) {
--
git-series 0.9.1
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2018-04-30 21:03 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-30 21:01 [PATCH 0/6] Fix XSA-155-like bugs in frontend drivers Marek Marczykowski-Górecki
2018-04-30 21:01 ` [PATCH 1/6] xen: Add RING_COPY_RESPONSE() Marek Marczykowski-Górecki
2018-04-30 21:25 ` Boris Ostrovsky
2018-04-30 21:25 ` Boris Ostrovsky
2018-04-30 21:27 ` Marek Marczykowski-Górecki
2018-04-30 21:41 ` Boris Ostrovsky
2018-04-30 21:41 ` Boris Ostrovsky
2018-04-30 21:27 ` Marek Marczykowski-Górecki
2018-04-30 21:01 ` Marek Marczykowski-Górecki
2018-04-30 21:01 ` [PATCH 2/6] xen-netfront: copy response out of shared buffer before accessing it Marek Marczykowski-Górecki
2018-04-30 21:01 ` Marek Marczykowski-Górecki
2018-05-02 5:20 ` Oleksandr Andrushchenko
2018-05-02 5:20 ` [Xen-devel] " Oleksandr Andrushchenko
2018-04-30 21:01 ` [PATCH 3/6] xen-netfront: do not use data already exposed to backend Marek Marczykowski-Górecki
2018-04-30 21:01 ` Marek Marczykowski-Górecki
2018-04-30 21:01 ` [PATCH 4/6] xen-netfront: add range check for Tx response id Marek Marczykowski-Górecki
2018-05-01 10:05 ` Wei Liu
2018-05-01 10:05 ` [Xen-devel] " Wei Liu
2018-05-01 10:05 ` Wei Liu
2018-04-30 21:01 ` Marek Marczykowski-Górecki [this message]
2018-04-30 21:01 ` [PATCH 5/6] xen-blkfront: make local copy of response before using it Marek Marczykowski-Górecki
2018-04-30 21:01 ` Marek Marczykowski-Górecki
2018-04-30 21:01 ` [PATCH 6/6] xen-blkfront: prepare request locally, only then put it on the shared ring Marek Marczykowski-Górecki
2018-04-30 21:01 ` Marek Marczykowski-Górecki
2018-05-01 8:22 ` Roger Pau Monné
2018-05-01 8:22 ` Roger Pau Monné
2018-05-01 8:22 ` Roger Pau Monné
2018-05-01 9:15 ` Roger Pau Monné
2018-05-01 9:15 ` [Xen-devel] " Roger Pau Monné
2018-05-01 9:15 ` Roger Pau Monné
2018-05-01 10:12 ` [PATCH 0/6] Fix XSA-155-like bugs in frontend drivers Wei Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='960c6d6300fd3450ae9fb1de1c412bef7dbae992.1525122026.git-series.marmarek__14164.3024435782$1525122106$gmane$org@invisiblethingslab.com' \
--to=marmarek@invisiblethingslab.com \
--cc=boris.ostrovsky@oracle.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.