From: Vishnu Dasa <vdasa@vmware.com> To: Artem Chernyshev <artem.chernyshev@red-soft.ru> Cc: Stefano Garzarella <sgarzare@redhat.com>, Pv-drivers <Pv-drivers@vmware.com>, Bryan Tan <bryantan@vmware.com>, Jakub Kicinski <kuba@kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Linux Virtualization <virtualization@lists.linux-foundation.org>, "netdev@vger.kernel.org" <netdev@vger.kernel.org>, "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>, "David S. Miller" <davem@davemloft.net> Subject: Re: [PATCH v3] net: vmw_vsock: vmci: Check memcpy_from_msg() Date: Mon, 5 Dec 2022 23:03:47 +0000 [thread overview] Message-ID: <C39CC4BC-E87C-4C6D-ADC9-A33E7696BD20@vmware.com> (raw) In-Reply-To: <20221205115200.2987942-1-artem.chernyshev@red-soft.ru> > On Dec 5, 2022, at 3:52 AM, Artem Chernyshev <artem.chernyshev@red-soft.ru> wrote: > > vmci_transport_dgram_enqueue() does not check the return value > of memcpy_from_msg(). Return with an error if the memcpy fails. I think we can add some more information in the description. Sorry, I should've said this earlier. vmci_transport_dgram_enqueue() does not check the return value of memcpy_from_msg(). If memcpy_from_msg() fails, it is possible that uninitialized memory contents are sent unintentionally instead of user's message in the datagram to the destination. Return with an error if memcpy_from_msg() fails. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr") > Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> Thanks, Artem! This version looks good to me modulo my suggestion about the description above. Reviewed-by: Vishnu Dasa <vdasa@vmware.com> Regards, Vishnu > --- > V1->V2 Fix memory leaking and updates for description > V2->V3 Return the value of memcpy_from_msg() > > net/vmw_vsock/vmci_transport.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c > index 842c94286d31..36eb16a40745 100644 > --- a/net/vmw_vsock/vmci_transport.c > +++ b/net/vmw_vsock/vmci_transport.c > @@ -1711,7 +1711,11 @@ static int vmci_transport_dgram_enqueue( > if (!dg) > return -ENOMEM; > > - memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); > + err = memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); > + if (err) { > + kfree(dg); > + return err; > + } > > dg->dst = vmci_make_handle(remote_addr->svm_cid, > remote_addr->svm_port); > -- > 2.30.3 >
WARNING: multiple messages have this Message-ID (diff)
From: Vishnu Dasa via Virtualization <virtualization@lists.linux-foundation.org> To: Artem Chernyshev <artem.chernyshev@red-soft.ru> Cc: "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>, Pv-drivers <Pv-drivers@vmware.com>, "netdev@vger.kernel.org" <netdev@vger.kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Linux Virtualization <virtualization@lists.linux-foundation.org>, Bryan Tan <bryantan@vmware.com>, Jakub Kicinski <kuba@kernel.org>, "David S. Miller" <davem@davemloft.net> Subject: Re: [PATCH v3] net: vmw_vsock: vmci: Check memcpy_from_msg() Date: Mon, 5 Dec 2022 23:03:47 +0000 [thread overview] Message-ID: <C39CC4BC-E87C-4C6D-ADC9-A33E7696BD20@vmware.com> (raw) In-Reply-To: <20221205115200.2987942-1-artem.chernyshev@red-soft.ru> > On Dec 5, 2022, at 3:52 AM, Artem Chernyshev <artem.chernyshev@red-soft.ru> wrote: > > vmci_transport_dgram_enqueue() does not check the return value > of memcpy_from_msg(). Return with an error if the memcpy fails. I think we can add some more information in the description. Sorry, I should've said this earlier. vmci_transport_dgram_enqueue() does not check the return value of memcpy_from_msg(). If memcpy_from_msg() fails, it is possible that uninitialized memory contents are sent unintentionally instead of user's message in the datagram to the destination. Return with an error if memcpy_from_msg() fails. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr") > Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> Thanks, Artem! This version looks good to me modulo my suggestion about the description above. Reviewed-by: Vishnu Dasa <vdasa@vmware.com> Regards, Vishnu > --- > V1->V2 Fix memory leaking and updates for description > V2->V3 Return the value of memcpy_from_msg() > > net/vmw_vsock/vmci_transport.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c > index 842c94286d31..36eb16a40745 100644 > --- a/net/vmw_vsock/vmci_transport.c > +++ b/net/vmw_vsock/vmci_transport.c > @@ -1711,7 +1711,11 @@ static int vmci_transport_dgram_enqueue( > if (!dg) > return -ENOMEM; > > - memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); > + err = memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); > + if (err) { > + kfree(dg); > + return err; > + } > > dg->dst = vmci_make_handle(remote_addr->svm_cid, > remote_addr->svm_port); > -- > 2.30.3 > _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
next prev parent reply other threads:[~2022-12-05 23:05 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-12-02 22:58 [PATCH] net: vmw_vsock: vmci: Check memcpy_from_msg() Artem Chernyshev 2022-12-03 1:17 ` Vishnu Dasa 2022-12-03 1:17 ` Vishnu Dasa via Virtualization 2022-12-03 7:56 ` Artem Chernyshev 2022-12-03 8:33 ` [PATCH v2] " Artem Chernyshev 2022-12-05 9:47 ` Stefano Garzarella 2022-12-05 9:47 ` Stefano Garzarella 2022-12-05 11:22 ` Artem Chernyshev 2022-12-05 11:52 ` [PATCH v3] " Artem Chernyshev 2022-12-05 13:06 ` Stefano Garzarella 2022-12-05 13:06 ` Stefano Garzarella 2022-12-05 23:03 ` Vishnu Dasa [this message] 2022-12-05 23:03 ` Vishnu Dasa via Virtualization 2022-12-06 6:52 ` Artem Chernyshev 2022-12-06 6:58 ` [PATCH v4] " Artem Chernyshev 2022-12-09 8:50 ` patchwork-bot+netdevbpf
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=C39CC4BC-E87C-4C6D-ADC9-A33E7696BD20@vmware.com \ --to=vdasa@vmware.com \ --cc=Pv-drivers@vmware.com \ --cc=artem.chernyshev@red-soft.ru \ --cc=bryantan@vmware.com \ --cc=davem@davemloft.net \ --cc=kuba@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=lvc-project@linuxtesting.org \ --cc=netdev@vger.kernel.org \ --cc=sgarzare@redhat.com \ --cc=virtualization@lists.linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.