netdev - Re: [PATCH] 9p/xen: fix check for xenbus_read error in front

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1808141003010.15066@sstabellini-ThinkPad-X260>
Date:   Tue, 14 Aug 2018 10:03:11 -0700 (PDT)
From:   Stefano Stabellini <sstabellini@...nel.org>
To:     Dominique Martinet <asmadeus@...ewreck.org>
cc:     v9fs-developer@...ts.sourceforge.net,
        Dominique Martinet <dominique.martinet@....fr>,
        netdev@...r.kernel.org,
        Stefano Stabellini <sstabellini@...nel.org>,
        Eric Van Hensbergen <ericvh@...il.com>,
        Latchesar Ionkov <lucho@...kov.net>
Subject: Re: [PATCH] 9p/xen: fix check for xenbus_read error in front_probe

On Tue, 14 Aug 2018, Dominique Martinet wrote:
> From: Dominique Martinet <dominique.martinet@....fr>
> 
> If the xen bus exists but does not expose the proper interface, it is
> possible to get a non-zero length but still some error, leading to
> strcmp failing trying to load invalid memory addresses e.g.
> fffffffffffffffe.
> 
> There is then no need to check length when there is no error, as the
> xenbus driver guarantees that the string is nul-terminated.
> 
> Signed-off-by: Dominique Martinet <dominique.martinet@....fr>
> Cc: Stefano Stabellini <sstabellini@...nel.org>
> Cc: Eric Van Hensbergen <ericvh@...il.com>
> Cc: Latchesar Ionkov <lucho@...kov.net>

Reviewed-by: Stefano Stabellini <sstabellini@...nel.org>


> ---
> 
> This is a trivial bug I stumbled on when setting up xen with p9fs and
> running the VM in pvm: it had enough in the bus to trigger the probe
> but then there was no version and it tried to return ENOENT but len
> was set to the lower-level message size.
> 
>  net/9p/trans_xen.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
> index 1a5b38892eb4..f76beadddfc3 100644
> --- a/net/9p/trans_xen.c
> +++ b/net/9p/trans_xen.c
> @@ -391,9 +391,9 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
>  	unsigned int max_rings, max_ring_order, len = 0;
>  
>  	versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
> -	if (!len)
> -		return -EINVAL;
> +	if (IS_ERR(versions))
> +		return PTR_ERR(versions);
>  	if (strcmp(versions, "1")) {
>  		kfree(versions);
>  		return -EINVAL;
>  	}
> -- 
> 2.17.1
>