linux-kernel - [PATCH V2 1/1] Revert "Drivers: hv: ring_buffer: count on wrap around mappings in get_next_pkt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1473189801-15913-1-git-send-email-kys@exchange.microsoft.com>
Date:   Tue,  6 Sep 2016 12:23:21 -0700
From:   kys@...hange.microsoft.com
To:     gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        devel@...uxdriverproject.org, olaf@...fle.de, apw@...onical.com,
        vkuznets@...hat.com, jasowang@...hat.com,
        leann.ogasawara@...onical.com, sfr@...b.auug.org.au,
        davem@...emloft.net, sthemmin@...rosoft.com, arnd@...db.de
Cc:     "K. Y. Srinivasan" <kys@...rosoft.com>
Subject: [PATCH V2 1/1] Revert "Drivers: hv: ring_buffer: count on wrap around mappings in get_next_pkt_raw()"

From: K. Y. Srinivasan <kys@...rosoft.com>

To deal with the merge conflict between net-next and char-misc trees,
revert commit bb08d431a914 from char-misc tree. This commit can be rebased
and applied once net-next picks up char-misc changes.

Here is the commit log of the reverted patch:
"With wrap around mappings in place we can always provide drivers with
direct links to packets on the ring buffer, even when they wrap around.
Do the required updates to get_next_pkt_raw()/put_pkt_raw()"

Signed-off-by: K. Y. Srinivasan <kys@...rosoft.com>
---
	V2: Added the log of the reverted patch (Greg)
	V2: Added the missing sign-off line (Greg)
	V2: Fix the subject line (Dan Carpenter)

 include/linux/hyperv.h |   32 +++++++++++++++++++++-----------
 1 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index c877e79..613074e 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1492,23 +1492,31 @@ static inline struct vmpacket_descriptor *
 get_next_pkt_raw(struct vmbus_channel *channel)
 {
 	struct hv_ring_buffer_info *ring_info = &channel->inbound;
-	u32 priv_read_loc = ring_info->priv_read_index;
+	u32 read_loc = ring_info->priv_read_index;
 	void *ring_buffer = hv_get_ring_buffer(ring_info);
+	struct vmpacket_descriptor *cur_desc;
+	u32 packetlen;
 	u32 dsize = ring_info->ring_datasize;
-	/*
-	 * delta is the difference between what is available to read and
-	 * what was already consumed in place. We commit read index after
-	 * the whole batch is processed.
-	 */
-	u32 delta = priv_read_loc >= ring_info->ring_buffer->read_index ?
-		priv_read_loc - ring_info->ring_buffer->read_index :
-		(dsize - ring_info->ring_buffer->read_index) + priv_read_loc;
+	u32 delta = read_loc - ring_info->ring_buffer->read_index;
 	u32 bytes_avail_toread = (hv_get_bytes_to_read(ring_info) - delta);
 
 	if (bytes_avail_toread < sizeof(struct vmpacket_descriptor))
 		return NULL;
 
-	return ring_buffer + priv_read_loc;
+	if ((read_loc + sizeof(*cur_desc)) > dsize)
+		return NULL;
+
+	cur_desc = ring_buffer + read_loc;
+	packetlen = cur_desc->len8 << 3;
+
+	/*
+	 * If the packet under consideration is wrapping around,
+	 * return failure.
+	 */
+	if ((read_loc + packetlen + VMBUS_PKT_TRAILER) > (dsize - 1))
+		return NULL;
+
+	return cur_desc;
 }
 
 /*
@@ -1520,14 +1528,16 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
 				struct vmpacket_descriptor *desc)
 {
 	struct hv_ring_buffer_info *ring_info = &channel->inbound;
+	u32 read_loc = ring_info->priv_read_index;
 	u32 packetlen = desc->len8 << 3;
 	u32 dsize = ring_info->ring_datasize;
 
+	if ((read_loc + packetlen + VMBUS_PKT_TRAILER) > dsize)
+		BUG();
 	/*
 	 * Include the packet trailer.
 	 */
 	ring_info->priv_read_index += packetlen + VMBUS_PKT_TRAILER;
-	ring_info->priv_read_index %= dsize;
 }
 
 /*
-- 
1.7.4.1