lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20160803.114223.772489117054301264.davem@davemloft.net> Date: Wed, 03 Aug 2016 11:42:23 -0700 (PDT) From: David Miller <davem@...emloft.net> To: ggarcia@...a.uab.cat Cc: netdev@...r.kernel.org, stefanha@...hat.com Subject: Re: [PATCH 1/1] virtio-vsock: Fix unbound rx buffer From: ggarcia@...a.uab.cat Date: Mon, 01 Aug 2016 19:18:21 +0200 > From: Gerard Garcia <ggarcia@...c.uab.cat> > > Reset connection and close rx socket when the sender is ignoring our announced available buffer. > > Signed-off-by: Gerard Garcia <ggarcia@...c.uab.cat> > --- > net/vmw_vsock/virtio_transport_common.c | 22 ++++++++++++++++------ > 1 file changed, 16 insertions(+), 6 deletions(-) > > diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c > index a53b3a1..3c38d43 100644 > --- a/net/vmw_vsock/virtio_transport_common.c > +++ b/net/vmw_vsock/virtio_transport_common.c > @@ -773,13 +773,23 @@ virtio_transport_recv_connected(struct sock *sk, > pkt->len = le32_to_cpu(pkt->hdr.len); > pkt->off = 0; > > - spin_lock_bh(&vvs->rx_lock); > - virtio_transport_inc_rx_pkt(vvs, pkt); > - list_add_tail(&pkt->list, &vvs->rx_queue); > - spin_unlock_bh(&vvs->rx_lock); > + if (vvs->rx_bytes + pkt->len <= vvs->buf_size) { > + spin_lock_bh(&vvs->rx_lock); > + virtio_transport_inc_rx_pkt(vvs, pkt); > + list_add_tail(&pkt->list, &vvs->rx_queue); > + spin_unlock_bh(&vvs->rx_lock); > + > + sk->sk_data_ready(sk); > + return err; > + } else { > + /* Sender is ignoring our buf_alloc */ > + spin_unlock_bh(&vvs->rx_lock); You don't hold vvs->rx_lock here, so it's a bug to try and release it. I'd also expect the maintainers of this driver to give some feedback before I apply this.
Powered by blists - more mailing lists