linux-kernel - Re: [PATCH] VMCI: Resource wildcard match fixed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20181009084322.GB16199@kroah.com>
Date:   Tue, 9 Oct 2018 10:43:22 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "Jorgen S. Hansen" <jhansen@...are.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "virtualization@...ts.linux-foundation.org" 
        <virtualization@...ts.linux-foundation.org>,
        pv-drivers <pv-drivers@...are.com>
Subject: Re: [PATCH] VMCI: Resource wildcard match fixed

On Tue, Oct 09, 2018 at 08:27:41AM +0000, Jorgen S. Hansen wrote:
> 
> 
> On 3 Oct 2018, at 00:35, Greg KH <gregkh@...uxfoundation.org<mailto:gregkh@...uxfoundation.org>> wrote:
> 
> On Fri, Sep 21, 2018 at 12:31:05AM -0700, Jorgen Hansen wrote:
> When adding a VMCI resource, the check for an existing entry
> would ignore that the new entry could be a wildcard. This could
> result in multiple resource entries that would match a given
> handle. One disastrous outcome of this is that the
> refcounting used to ensure that delayed callbacks for VMCI
> datagrams have run before the datagram is destroyed can be
> wrong, since the refcount could be increased on the duplicate
> entry. This in turn leads to a use after free bug. This issue
> was discovered by Hangbin Liu using KASAN and syzkaller.
> 
> Fixes: bc63dedb7d46 ("VMCI: resource object implementation")
> Reported-by: Hangbin Liu <liuhangbin@...il.com<mailto:liuhangbin@...il.com>>
> Reviewed-by: Adit Ranadive <aditr@...are.com<mailto:aditr@...are.com>>
> Reviewed-by: Vishnu Dasa <vdasa@...are.com<mailto:vdasa@...are.com>>
> Signed-off-by: Jorgen Hansen <jhansen@...are.com<mailto:jhansen@...are.com>>
> ---
> drivers/misc/vmw_vmci/vmci_driver.c   | 2 +-
> drivers/misc/vmw_vmci/vmci_resource.c | 3 ++-
> 2 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
> index d7eaf1eb11e7..003bfba40758 100644
> --- a/drivers/misc/vmw_vmci/vmci_driver.c
> +++ b/drivers/misc/vmw_vmci/vmci_driver.c
> @@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
> 
> MODULE_AUTHOR("VMware, Inc.");
> MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
> -MODULE_VERSION("1.1.5.0-k");
> +MODULE_VERSION("1.1.6.0-k");
> MODULE_LICENSE("GPL v2");
> 
> You do know MODULE_VERSION means nothing, right?  Please just remove it.
> 
> Sure. Do you want a new version of this patch with it removed ? (The reason for asking is that I already got a couple of notifications about the patch being added to char-misc and char-misc-next).

Just send a follow-on patch that removes it please.

thanks,

greg k-h