linux-kernel - Re: [PATCH v2] Drivers: hv: vmbus: Initialize unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210420194049.vsmax7bseebb324x@liuwe-devbox-debian-v2>
Date:   Tue, 20 Apr 2021 19:40:49 +0000
From:   Wei Liu <wei.liu@...nel.org>
To:     Michael Kelley <mikelley@...rosoft.com>
Cc:     "Andrea Parri (Microsoft)" <parri.andrea@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>
Subject: Re: [PATCH v2] Drivers: hv: vmbus: Initialize unload_event statically

On Tue, Apr 20, 2021 at 04:50:56AM +0000, Michael Kelley wrote:
> From: Andrea Parri (Microsoft) <parri.andrea@...il.com> Sent: Monday, April 19, 2021 6:44 PM
> > 
> > If a malicious or compromised Hyper-V sends a spurious message of type
> > CHANNELMSG_UNLOAD_RESPONSE, the function vmbus_unload_response() will
> > call complete() on an uninitialized event, and cause an oops.
> > 
> > Reported-by: Michael Kelley <mikelley@...rosoft.com>
> > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> > ---
> > Changes since v1[1]:
> >   - add inline comment in vmbus_unload_response()
> > 
> > [1] https://lore.kernel.org/linux-hyperv/20210416143932.16512-1-parri.andrea@gmail.com/
> > 
> >  drivers/hv/channel_mgmt.c | 7 ++++++-
> >  drivers/hv/connection.c   | 2 ++
> >  2 files changed, 8 insertions(+), 1 deletion(-)
> > 
> 
> Reviewed-by: Michael Kelley <mikelley@...rosoft.com>

Applied to hyperv-next. Thanks.