lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20210729133702.11383-1-sidcha@amazon.de>
Date:   Thu, 29 Jul 2021 15:37:02 +0200
From:   Siddharth Chandrasekaran <sidcha@...zon.de>
To:     "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
        Arnd Bergmann <arnd@...db.de>
CC:     Siddharth Chandrasekaran <sidcha.dev@...il.com>,
        Liran Alon <liran@...zon.com>,
        Ioannis Aslanidis <iaslan@...zon.de>,
        <linux-hyperv@...r.kernel.org>, <linux-arch@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        Siddharth Chandrasekaran <sidcha@...zon.de>
Subject: [PATCH] asm-generic/hyperv: Fix struct hv_message_header ordering

According to Hyper-V TLFS Version 6.0b, struct hv_message_header members
should be defined in the order:

	message_type, reserved, message_flags, payload_size

but we have it defined in the order:

	message_type, payload_size, message_flags, reserved

that is, the payload_size and reserved members swapped. Due to this mix
up, we were inadvertently causing two issues:

    - The payload_size field has invalid data; it didn't cause an issue
      so far because we are delivering only timer messages which has fixed
      size payloads the guest probably did a sizeof(payload) instead
      relying on the value of payload_size member.

    - The message_flags was always delivered as 0 to the guest;
      fortunately, according to section 13.3.1 message_flags is also
      treated as a reserved field.

Although this is not causing an issue now, it might in future (we are
adding more message types in our VSM implementation) so fix it to
reflect the specification.

Signed-off-by: Siddharth Chandrasekaran <sidcha@...zon.de>
---
 include/asm-generic/hyperv-tlfs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/hyperv-tlfs.h b/include/asm-generic/hyperv-tlfs.h
index 56348a541c50..a5540e9b171f 100644
--- a/include/asm-generic/hyperv-tlfs.h
+++ b/include/asm-generic/hyperv-tlfs.h
@@ -284,9 +284,9 @@ union hv_port_id {
 /* Define synthetic interrupt controller message header. */
 struct hv_message_header {
 	__u32 message_type;
-	__u8 payload_size;
-	union hv_message_flags message_flags;
 	__u8 reserved[2];
+	union hv_message_flags message_flags;
+	__u8 payload_size;
 	union {
 		__u64 sender;
 		union hv_port_id port;
-- 
2.17.1




Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ