linux-kernel - Re: [PATCH] ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5464224.fTvfEN5hHQ@kreacher>
Date:   Sat, 09 Jan 2021 18:08:24 +0100
From:   "Rafael J. Wysocki" <rjw@...ysocki.net>
To:     Dexuan Cui <decui@...rosoft.com>
Cc:     Andy Shevchenko <andy.shevchenko@...il.com>,
        "rafael@...nel.org" <rafael@...nel.org>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
        "len.brown@...el.com" <len.brown@...el.com>,
        Michael Kelley <mikelley@...rosoft.com>,
        "rui.zhang@...el.com" <rui.zhang@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        KY Srinivasan <kys@...rosoft.com>,
        "dwaipayanray1@...il.com" <dwaipayanray1@...il.com>
Subject: Re: [PATCH] ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow

On Saturday, January 9, 2021 10:37:41 AM CET Dexuan Cui wrote:
> > From: Andy Shevchenko <andy.shevchenko@...il.com> 
> > Sent: Saturday, January 9, 2021 12:52 AM
> >> 
> >> Hi Rafael, Len, and all,
> >> Can you please take a look at the v2 patch?
> >> 
> >> The Linux mainline has been broken for several weeks when it
> >> runs as a guest on Hyper-V, so we'd like this to be fixed ASAP,
> >> as more people are being affected
> > 
> > I would like to see a warning printed when the dupped
> > string violates the spec.
> 
> Hi Andy,
> Do you want a simple strlen() check like the below, or a full
> check of the AAA#### or NNNN#### format?

It would be good to check the format too while at it.

> Can we have the v2 (https://lkml.org/lkml/2021/1/8/53) merged 
> first, and then we can add another patch for the format checking?

Yes, we can.

I'm going to apply the v2 early next week.

Thanks!