linux-kernel - Re: [PATCH] ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0hT4STe8wyxUWLjYkzHYnn9FgJWaabqJFZtz=eyGtjinA@mail.gmail.com>
Date:   Mon, 11 Jan 2021 20:50:44 +0100
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Dexuan Cui <decui@...rosoft.com>
Cc:     Andy Shevchenko <andy.shevchenko@...il.com>,
        "rafael@...nel.org" <rafael@...nel.org>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
        "len.brown@...el.com" <len.brown@...el.com>,
        Michael Kelley <mikelley@...rosoft.com>,
        "rui.zhang@...el.com" <rui.zhang@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        KY Srinivasan <kys@...rosoft.com>,
        "dwaipayanray1@...il.com" <dwaipayanray1@...il.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>
Subject: Re: [PATCH] ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow

On Sat, Jan 9, 2021 at 6:08 PM Rafael J. Wysocki <rjw@...ysocki.net> wrote:
>
> On Saturday, January 9, 2021 10:37:41 AM CET Dexuan Cui wrote:
> > > From: Andy Shevchenko <andy.shevchenko@...il.com>
> > > Sent: Saturday, January 9, 2021 12:52 AM
> > >>
> > >> Hi Rafael, Len, and all,
> > >> Can you please take a look at the v2 patch?
> > >>
> > >> The Linux mainline has been broken for several weeks when it
> > >> runs as a guest on Hyper-V, so we'd like this to be fixed ASAP,
> > >> as more people are being affected
> > >
> > > I would like to see a warning printed when the dupped
> > > string violates the spec.
> >
> > Hi Andy,
> > Do you want a simple strlen() check like the below, or a full
> > check of the AAA#### or NNNN#### format?
>
> It would be good to check the format too while at it.
>
> > Can we have the v2 (https://lkml.org/lkml/2021/1/8/53) merged
> > first, and then we can add another patch for the format checking?
>
> Yes, we can.
>
> I'm going to apply the v2 early next week.

Applied now with a new subject ("ACPI: scan: Harden acpi_device_add()
against device ID overflows") and slightly adjusted white space,
thanks!