lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Apr 2022 22:47:37 +0200 From: "Andrea Parri (Microsoft)" <parri.andrea@...il.com> To: KY Srinivasan <kys@...rosoft.com>, Haiyang Zhang <haiyangz@...rosoft.com>, Stephen Hemminger <sthemmin@...rosoft.com>, Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>, Michael Kelley <mikelley@...rosoft.com>, Stefano Garzarella <sgarzare@...hat.com>, David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com> Cc: linux-hyperv@...r.kernel.org, virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, "Andrea Parri (Microsoft)" <parri.andrea@...il.com> Subject: [RFC PATCH 1/6] hv_sock: Check hv_pkt_iter_first_raw()'s return value The function returns NULL if the ring buffer has no enough space available for a packet descriptor. The ring buffer's write_index is in memory which is shared with the Hyper-V host, its value is thus subject to being changed at any time. Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@...il.com> --- net/vmw_vsock/hyperv_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c index e111e13b66604..943352530936e 100644 --- a/net/vmw_vsock/hyperv_transport.c +++ b/net/vmw_vsock/hyperv_transport.c @@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg, if (need_refill) { hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan); + if (!hvs->recv_desc) + return -ENOBUFS; ret = hvs_update_recv_data(hvs); if (ret) return ret; -- 2.25.1
Powered by blists - more mailing lists