linux-kernel - [PATCH v2] rpmsg: virtio: don't let virtio core to validate used length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211124162045.25983-1-arnaud.pouliquen@foss.st.com>
Date:   Wed, 24 Nov 2021 17:20:45 +0100
From:   Arnaud Pouliquen <arnaud.pouliquen@...s.st.com>
To:     Bjorn Andersson <bjorn.andersson@...aro.org>,
        Ohad Ben-Cohen <ohad@...ery.com>,
        Mathieu Poirier <mathieu.poirier@...aro.org>
CC:     <linux-remoteproc@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-stm32@...md-mailman.stormreply.com>,
        <arnaud.pouliquen@...s.st.com>, Jason Wang <jasowang@...hat.com>,
        "Michael S . Tsirkin" <mst@...hat.com>
Subject: [PATCH v2] rpmsg: virtio: don't let virtio core to validate used length

Using OpenAMP library on remote side, when the rpmsg framework tries to
reuse the buffer the following error message is displayed in
the virtqueue_get_buf_ctx_split function:
"virtio_rpmsg_bus virtio0: output:used len 28 is larger than in buflen 0"

As described in virtio specification:
"many drivers ignored the len value, as a result, many devices set len
incorrectly. Thus, when using the legacy interface, it is generally
a good idea to ignore the len value in used ring entries if possible."

To stay in compliance with the legacy libraries, this patch prevents the
virtio core from validating used length.

Fixes: 939779f5152d ("virtio_ring: validate used buffer length")

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@...s.st.com>
Cc: Jason Wang <jasowang@...hat.com>
Cc: Michael S. Tsirkin <mst@...hat.com>
---
Update vs v1[1]: update commit message to clarify the context.

base-commit: fa55b7dcdc43c1aa1ba12bca9d2dd4318c2a0dbf

[1]https://lore.kernel.org/lkml/20211122160812.25125-1-arnaud.pouliquen@foss.st.com/T/
---
 drivers/rpmsg/virtio_rpmsg_bus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 9c112aa65040..5f73f19c2c38 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -1054,6 +1054,7 @@ static struct virtio_driver virtio_ipc_driver = {
 	.feature_table_size = ARRAY_SIZE(features),
 	.driver.name	= KBUILD_MODNAME,
 	.driver.owner	= THIS_MODULE,
+	.suppress_used_validation = true,
 	.id_table	= id_table,
 	.probe		= rpmsg_probe,
 	.remove		= rpmsg_remove,
-- 
2.17.1