linux-kernel - [PATCH linux-next] xen/multicall: xen_mc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1360355677-52442-1-git-send-email-tim.gardner@canonical.com>
Date:	Fri,  8 Feb 2013 13:34:37 -0700
From:	Tim Gardner <tim.gardner@...onical.com>
To:	linux-kernel@...r.kernel.org
Cc:	Tim Gardner <tim.gardner@...onical.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
	Jeremy Fitzhardinge <jeremy@...p.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	xen-devel@...ts.xensource.com,
	virtualization@...ts.linux-foundation.org, stable@...r.kernel.org
Subject: [PATCH linux-next] xen/multicall: xen_mc_callback(): avoid buffer overflow

This buffer overflow was introduced with 91e0c5f3dad47838cb2ecc1865ce789a0b7182b1
(2.6.24).

Cc: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Cc: Jeremy Fitzhardinge <jeremy@...p.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: x86@...nel.org
Cc: xen-devel@...ts.xensource.com
Cc: virtualization@...ts.linux-foundation.org
Cc: stable@...r.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@...onical.com>
---

This patch applies cleanly to 3.1.10 and newer. Requires a backport
for 2.6.24-3.2.y

 arch/x86/xen/multicalls.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 0d82003..5270407 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -195,9 +195,10 @@ void xen_mc_callback(void (*fn)(void *), void *data)
 	struct mc_buffer *b = &__get_cpu_var(mc_buffer);
 	struct callback *cb;
 
-	if (b->cbidx == MC_BATCH) {
+	if (b->cbidx >= MC_BATCH) {
 		trace_xen_mc_flush_reason(XEN_MC_FL_CALLBACK);
 		xen_mc_flush();
+		return;
 	}
 
 	trace_xen_mc_callback(fn, data);
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/