linux-kernel - RE: [PATCH] Drivers: vmbus: Check for channel allocation before looking up relids

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 8 Feb 2023 19:02:59 +0000
From:   Dexuan Cui <decui@...rosoft.com>
To:     Mohammed Gamal <mgamal@...hat.com>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "Michael Kelley (LINUX)" <mikelley@...rosoft.com>,
        "parri.andrea@...il.com" <parri.andrea@...il.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>
Subject: RE: [PATCH] Drivers: vmbus: Check for channel allocation before
 looking up relids

> From: Mohammed Gamal <mgamal@...hat.com>
> Sent: Wednesday, February 8, 2023 3:34 AM
> 
> relid2channel() assumes vmbus channel array to be allocated when called.
> However, if the guest receives a vmbus interrupt during driver initialization
> before vmbus_connect() is called or if vmbus_connect() fails, the vmbus
> interrupt service routine is called which in turn calls relid2channel()
> and can cause a null pointer dereference.

Before vmbus_connect() is called or if vmbus_connect() fails, there should
be no VMBus channel related interrupts at all, so relid2channel() can't be
called. 

Can you please share the log or at least the crash call-stack?
I'm curious how the crash can happen.