linux-kernel - Re: [PATCH v8 3/3] hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 4 Nov 2020 13:43:48 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     "Andrea Parri (Microsoft)" <parri.andrea@...il.com>
Cc:     linux-kernel@...r.kernel.org,
        "K . Y . Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Wei Liu <wei.liu@...nel.org>, linux-hyperv@...r.kernel.org,
        Andres Beltran <lkmlabelt@...il.com>,
        Michael Kelley <mikelley@...rosoft.com>,
        Saruhan Karademir <skarade@...rosoft.com>,
        Juan Vazquez <juvazq@...rosoft.com>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH v8 3/3] hv_netvsc: Use vmbus_requestor to generate
 transaction IDs for VMBus hardening

On Wed,  4 Nov 2020 16:40:27 +0100 Andrea Parri (Microsoft) wrote:
> From: Andres Beltran <lkmlabelt@...il.com>
> 
> Currently, pointers to guest memory are passed to Hyper-V as
> transaction IDs in netvsc. In the face of errors or malicious
> behavior in Hyper-V, netvsc should not expose or trust the transaction
> IDs returned by Hyper-V to be valid guest memory addresses. Instead,
> use small integers generated by vmbus_requestor as requests
> (transaction) IDs.
> 
> Signed-off-by: Andres Beltran <lkmlabelt@...il.com>
> Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Reviewed-by: Michael Kelley <mikelley@...rosoft.com>

I'm assuming this is targeting net-next? If so could you please tag it
as [PATCH net-next vN]?

> @@ -695,10 +695,19 @@ static void netvsc_send_tx_complete(struct net_device *ndev,
>  				    const struct vmpacket_descriptor *desc,
>  				    int budget)
>  {
> -	struct sk_buff *skb = (struct sk_buff *)(unsigned long)desc->trans_id;
> +	struct sk_buff *skb;
>  	struct net_device_context *ndev_ctx = netdev_priv(ndev);

Swap these two lines please to keep the variables declaration lines
longest to shortest.