lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 13 Apr 2022 22:47:37 +0200
From:   "Andrea Parri (Microsoft)" <>
To:     KY Srinivasan <>,
        Haiyang Zhang <>,
        Stephen Hemminger <>,
        Wei Liu <>, Dexuan Cui <>,
        Michael Kelley <>,
        Stefano Garzarella <>,
        David Miller <>,
        Jakub Kicinski <>,
        Paolo Abeni <>
        "Andrea Parri (Microsoft)" <>
Subject: [RFC PATCH 1/6] hv_sock: Check hv_pkt_iter_first_raw()'s return value

The function returns NULL if the ring buffer has no enough space
available for a packet descriptor.  The ring buffer's write_index
is in memory which is shared with the Hyper-V host, its value is
thus subject to being changed at any time.

Signed-off-by: Andrea Parri (Microsoft) <>
 net/vmw_vsock/hyperv_transport.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index e111e13b66604..943352530936e 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg,
 	if (need_refill) {
 		hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan);
+		if (!hvs->recv_desc)
+			return -ENOBUFS;
 		ret = hvs_update_recv_data(hvs);
 		if (ret)
 			return ret;

Powered by blists - more mailing lists