linux-kernel - Re: [PATCH 1/1] xen-netfront: do not cast grant table reference to signed short

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2016 21:46:09 -0700 (PDT)
From:   Dongli Zhang <dongli.zhang@...cle.com>
To:     <davem@...emloft.net>, JBeulich <JBeulich@...e.com>
Cc:     <boris.ostrovsky@...cle.com>, <jgross@...e.com>,
        <netdev@...r.kernel.org>, <xen-devel@...ts.xenproject.org>,
        <david.vrabel@...rix.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] xen-netfront: do not cast grant table reference to
 signed short

Hi David and Jan,

I did more testing on the code. Casting to either (long) or (unsigned long)
would be fine.

However, there is still an issue that ref is of type uint32_t and
IS_ERR_VALUE((unsigned long)ref) would not return true when ref=-ENOSPC (or
other error code).

IS_ERR_VALUE((long)ref) would return false as well.

The solution is to cast ref to (int) first as follows:

-   BUG_ON((signed short)ref < 0);
+   WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));

David, I am very sorry for this error and I will be careful the next time.
Would you please let me know if I should resend a new patch or an incremental
based on previous one at 
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git?

Thank you very much!

Dongli Zhang

----- Original Message -----
From: davem@...emloft.net
To: dongli.zhang@...cle.com
Cc: linux-kernel@...r.kernel.org, xen-devel@...ts.xenproject.org, netdev@...r.kernel.org, boris.ostrovsky@...cle.com, david.vrabel@...rix.com, jgross@...e.com
Sent: Tuesday, November 1, 2016 4:06:27 AM GMT +08:00 Beijing / Chongqing / Hong Kong / Urumqi
Subject: Re: [PATCH 1/1] xen-netfront: do not cast grant table reference to signed short

From: Dongli Zhang <dongli.zhang@...cle.com>
Date: Mon, 31 Oct 2016 13:38:29 +0800

> While grant reference is of type uint32_t, xen-netfront erroneously casts
> it to signed short in BUG_ON().
> 
> This would lead to the xen domU panic during boot-up or migration when it
> is attached with lots of paravirtual devices.
> 
> Signed-off-by: Dongli Zhang <dongli.zhang@...cle.com>

Since this is consistent with how the macros in linux/err.h handle "is
this an error" checks, this change looks good to me.

Applied, thanks.