linux-kernel - [PATCH 5/5] rpmsg: fix published buffer length in rpmsg_recv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 28 Feb 2012 19:21:12 +0200
From:	Ohad Ben-Cohen <ohad@...ery.com>
To:	<linux-kernel@...r.kernel.org>
Cc:	<linux-omap@...r.kernel.org>,
	<linux-arm-kernel@...ts.infradead.org>,
	Ohad Ben-Cohen <ohad@...ery.com>,
	Grant Likely <grant.likely@...retlab.ca>,
	Arnd Bergmann <arnd@...db.de>, Mark Grosen <mgrosen@...com>,
	Suman Anna <s-anna@...com>,
	Fernando Guzman Lugo <fernando.lugo@...com>,
	Rob Clark <rob@...com>,
	Ludovic BARRE <ludovic.barre@...ricsson.com>,
	Loic PALLARDY <loic.pallardy@...ricsson.com>,
	Omar Ramirez Luna <omar.luna@...aro.org>
Subject: [PATCH 5/5] rpmsg: fix published buffer length in rpmsg_recv_done

After processing an incoming message, always publish the real size
of its containing buffer when putting it back on the available rx ring.

Using any different value might erroneously limit the remote processor
(leading it to think the buffer is smaller than it really is).

Signed-off-by: Ohad Ben-Cohen <ohad@...ery.com>
Cc: Grant Likely <grant.likely@...retlab.ca>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Mark Grosen <mgrosen@...com>
Cc: Suman Anna <s-anna@...com>
Cc: Fernando Guzman Lugo <fernando.lugo@...com>
Cc: Rob Clark <rob@...com>
Cc: Ludovic BARRE <ludovic.barre@...ricsson.com>
Cc: Loic PALLARDY <loic.pallardy@...ricsson.com>
Cc: Omar Ramirez Luna <omar.luna@...aro.org>
---
 drivers/rpmsg/virtio_rpmsg_bus.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 1e8b8b6..f93ca3b 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -798,7 +798,8 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
 	else
 		dev_warn(dev, "msg received with no recepient\n");
 
-	sg_init_one(&sg, msg, sizeof(*msg) + len);
+	/* publish the real size of the buffer */
+	sg_init_one(&sg, msg, RPMSG_BUF_SIZE);
 
 	/* add the buffer back to the remote processor's virtqueue */
 	err = virtqueue_add_buf(vrp->rvq, &sg, 0, 1, msg, GFP_KERNEL);
-- 
1.7.5.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/