linux-kernel - [PATCH] Drivers: hv: fcopy: restore correct transfer length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20170825122751.29485-1-olaf@aepfle.de>
Date:   Fri, 25 Aug 2017 14:27:51 +0200
From:   Olaf Hering <olaf@...fle.de>
To:     "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        devel@...uxdriverproject.org (open list:Hyper-V CORE AND DRIVERS),
        linux-kernel@...r.kernel.org (open list)
Cc:     Olaf Hering <olaf@...fle.de>
Subject: [PATCH] Drivers: hv: fcopy: restore correct transfer length

Prior commit c7e490fc23eb the expected length of bytes read by the
daemon did depend on the context. It was either hv_start_fcopy or
hv_do_fcopy. The daemon had a buffer size of two pages, which was much
larger than needed.

Since commit c7e490fc23eb the expected length of bytes read by the
daemon changed slightly. For START_FILE_COPY it is still the size of
hv_start_fcopy.  But for WRITE_TO_FILE and the other operations it is as
large as the buffer that arrived via vmbus. In case of WRITE_TO_FILE
that is slightly larger than a struct hv_do_fcopy. Since the buffer in
the daemon was still larger everything was fine.

After commit 3f2baa8a7d2e the daemon reads only what is actually needed.
The new buffer layout is as large as a struct hv_do_fcopy, for the
WRITE_TO_FILE operation. Since the kernel expects a slightly larger
size, hvt_op_read will return -EINVAL because the daemon will read
slightly less than expected.

Fix this by restoring the expected buffer size in case of WRITE_TO_FILE.

Fixes: c7e490fc23eb ("Drivers: hv: fcopy: convert to hv_utils_transport")
Fixes: 3f2baa8a7d2e ("Tools: hv: update buffer handling in hv_fcopy_daemon")

Signed-off-by: Olaf Hering <olaf@...fle.de>
---
 drivers/hv/hv_fcopy.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index daa75bd41f86..2364281d8593 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy)
 		out_src = smsg_out;
 		break;

+	case WRITE_TO_FILE:
+		out_src = fcopy_transaction.fcopy_msg;
+		out_len = sizeof(struct hv_do_fcopy);
+		break;
 	default:
 		out_src = fcopy_transaction.fcopy_msg;
 		out_len = fcopy_transaction.recv_len;