linux-kernel - [PATCH] VMCI: Verify PPNs before sending to device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Jan 2019 08:57:45 -0800
From:   Jorgen Hansen <jhansen@...are.com>
To:     <linux-kernel@...r.kernel.org>,
        <virtualization@...ts.linux-foundation.org>
CC:     <gregkh@...uxfoundation.org>, <pv-drivers@...are.com>,
        Jorgen Hansen <jhansen@...are.com>
Subject: [PATCH] VMCI: Verify PPNs before sending to device

The current version of the VMCI device only supports 32 bit PPNs,
so check whether we are truncating PPNs, and fail the operation
if we do. One such check did exist, but was wrong. Another
check was missing.

Testing through code modification: constructed PPN not representable
by 32-bit and observed that failure was reported.

Fixes: 1f166439917b ("VMCI: guest side driver implementation.")
Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")

Signed-off-by: Jorgen Hansen <jhansen@...are.com>
Reviewed-by: Adit Ranadive <aditr@...are.com>
Reviewed-by: Vishnu Dasa <vdasa@...are.com>
---
 drivers/misc/vmw_vmci/vmci_guest.c      | 10 +++++++---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index dad5abee656e..02bb3866cf9e 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -532,10 +532,14 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
 	if (capabilities & VMCI_CAPS_NOTIFICATIONS) {
 		unsigned long bitmap_ppn =
 			vmci_dev->notification_base >> PAGE_SHIFT;
-		if (!vmci_dbell_register_notification_bitmap(bitmap_ppn)) {
+		u32 bitmap_ppn32 = bitmap_ppn;
+
+		if ((sizeof(bitmap_ppn) > sizeof(bitmap_ppn32)
+		     && bitmap_ppn != bitmap_ppn32) ||
+		    !vmci_dbell_register_notification_bitmap(bitmap_ppn)) {
 			dev_warn(&pdev->dev,
-				 "VMCI device unable to register notification bitmap with PPN 0x%x\n",
-				 (u32) bitmap_ppn);
+				 "VMCI device unable to register notification bitmap with PPN 0x%lx\n",
+				 bitmap_ppn);
 			error = -ENXIO;
 			goto err_remove_vmci_dev_g;
 		}
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 264f4ed8eef2..1da4f6cb01b2 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -465,9 +465,8 @@ static int qp_alloc_ppn_set(void *prod_q,
 	for (i = 0; i < num_produce_pages; i++) {
 		unsigned long pfn;
 
-		produce_ppns[i] =
-			produce_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
-		pfn = produce_ppns[i];
+		pfn = produce_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
+		produce_ppns[i] = pfn;
 
 		/* Fail allocation if PFN isn't supported by hypervisor. */
 		if (sizeof(pfn) > sizeof(*produce_ppns)
@@ -478,9 +477,8 @@ static int qp_alloc_ppn_set(void *prod_q,
 	for (i = 0; i < num_consume_pages; i++) {
 		unsigned long pfn;
 
-		consume_ppns[i] =
-			consume_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
-		pfn = consume_ppns[i];
+		pfn = consume_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
+		consume_ppns[i] = pfn;
 
 		/* Fail allocation if PFN isn't supported by hypervisor. */
 		if (sizeof(pfn) > sizeof(*consume_ppns)
-- 
2.17.1