system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-22 20:37:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers
History
Ian Campbell 9e7860cee1 xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX. 
Haogang Chen found out that:

 There is a potential integer overflow in process_msg() that could result
 in cross-domain attack.

 	body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);

 When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
 call to xb_read() would write to a zero-length buffer.

 The other end of this connection is always the xenstore backend daemon
 so there is no guest (malicious or otherwise) which can do this. The
 xenstore daemon is a trusted component in the system.

 However this seem like a reasonable robustness improvement so we should
 have it.

And Ian when read the API docs found that:
        The payload length (len field of the header) is limited to 4096
        (XENSTORE_PAYLOAD_MAX) in both directions.  If a client exceeds the
        limit, its xenstored connection will be immediately killed by
        xenstored, which is usually catastrophic from the client's point of
        view.  Clients (particularly domains, which cannot just reconnect)
        should avoid this.

so this patch checks against that instead.

This also avoids a potential integer overflow pointed out by Haogang Chen.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Haogang Chen <haogangchen@gmail.com>
CC: stable@kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2012-01-04 17:02:03 -05:00
..
accessibility
acpi ACPI / cpuidle: Remove acpi_idle_suspend (to fix suspend regression) 2011-11-12 21:30:14 -02:00
amba
ata libata: fix build without BMDMA 2011-11-17 02:11:42 -05:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2011-10-25 13:25:22 +02:00
auxdisplay
base Merge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core 2011-11-21 20:36:26 -08:00
bcma bcma: fix implicit use of export.h contents 2011-10-31 19:32:02 -04:00
block Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
bluetooth Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2011-11-09 16:22:15 -05:00
cdrom
char fix typo/thinko in get_random_bytes() 2011-11-17 11:42:54 -02:00
clk
clocksource Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
connector
cpufreq [CPUFREQ] db8500: fix build error due to undeclared i variable 2011-11-11 22:28:33 -05:00
cpuidle Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2011-11-07 10:13:52 -08:00
crypto Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
dca drivers/dca: Add export.h for THIS_MODULE to dca-sysfs.c 2011-10-31 19:31:43 -04:00
devfreq PM / devfreq: correct Kconfig dependency 2011-11-14 23:31:35 +01:00
dio
dma Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
edac Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
eisa
firewire Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
firmware drivers/firmware/dmi_scan.c: make dmi_name_in_vendors more focused 2011-11-15 22:41:51 -02:00
gpio Merge branch 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6 2011-11-15 14:45:50 -02:00
gpu Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux 2011-11-23 09:47:25 -08:00
hid Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
hv
hwmon hwmon: (exynos4_tmu) Fix Kconfig dependency 2011-11-17 03:16:19 -08:00
hwspinlock Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-08 18:34:16 -08:00
i2c i2c: Make i2cdev_notifier_call static 2011-11-23 11:33:07 +01:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2011-11-18 22:04:12 -02:00
idle Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2011-11-07 10:13:52 -08:00
ieee802154
infiniband Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
input Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
iommu iommu: omap: Fix compile failure 2011-11-08 17:11:57 +01:00
isdn Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
leds Revert "leds: save the delay values after a successful call to blink_set()" 2011-11-15 22:41:50 -02:00
lguest lguest: add export.h to lguest files for THIS_MODULE/EXPORT_SYMBOL 2011-10-31 19:32:13 -04:00
macintosh m68k/irq: Remove obsolete IRQ_FLG_* users 2011-11-08 22:35:48 +01:00
mca
md md/raid5: STRIPE_ACTIVE has lock semantics, add barriers 2011-11-08 16:22:06 +11:00
media Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2011-11-12 00:03:50 -02:00
memstick drivers/memstick: Add module.h to the prev. implicit modular users 2011-10-31 19:31:52 -04:00
message drivers/message: Add module.h to i2o/pci.c 2011-10-31 19:31:53 -04:00
mfd mfd: fix build failures in recently added ab5500 code 2011-11-07 21:45:14 -05:00
misc Merge branch 'char-misc-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2011-11-21 20:36:05 -08:00
mmc arm/imx: fix imx6q mmc error when mounting rootfs 2011-11-11 16:53:35 +01:00
mtd MTD: MAPS: bcm963xx-flash.c: explicitly include module.h 2011-11-07 21:26:55 -05:00
net Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
nfc drivers/nfc: add module.h to nfcwilink.c 2011-10-31 19:31:54 -04:00
nubus
of Revert "of/irq: of_irq_find_parent: check for parent equal to child" 2011-11-22 15:09:20 -08:00
oprofile
parisc parisc: add module.h to files really requiring it 2011-10-31 19:31:01 -04:00
parport
pci Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
pcmcia Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
pinctrl pinctrl: hide subsystem from the populace 2011-11-10 09:02:12 +01:00
platform platform/x86: fix dell-laptop function prototypes 2011-11-17 10:29:02 -02:00
pnp Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2011-11-07 10:13:52 -08:00
power Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
pps pps gpio client: add missing dependency 2011-11-02 16:07:02 -07:00
ps3 powerpc/ps3: irq: Remove IRQF_DISABLED 2011-11-08 14:51:46 +11:00
ptp
rapidio Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
regulator regulator: TPS65910: Fix VDD1/2 voltage selector count 2011-11-23 14:03:52 +00:00
rtc rtc: rtc-puv3: Add __devinit and __devexit markers for probe and remove 2011-11-15 17:13:17 +08:00
s390 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2011-11-20 14:59:33 -08:00
sbus
scsi [SCSI] hpsa: Disable ASPM 2011-11-14 10:47:01 -06:00
sfi drivers/sfi: sfi_acpi.c needs sysfs.h 2011-10-31 19:31:57 -04:00
sh Merge branches 'sh/pm-runtime' and 'common/clkfwk' into sh-fixes-for-linus 2011-11-11 16:16:25 +09:00
sn
spi Merge branch 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm 2011-11-20 14:34:58 -08:00
ssb ssb: Add export.h to files using EXPORT_SYMBOL/THIS_MODULE 2011-10-31 19:32:08 -04:00
staging Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2011-11-22 13:19:21 -08:00
target Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
tc
telephony
thermal thermal: Prevent polling from happening during system suspend 2011-11-06 20:38:49 -05:00
tty Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty 2011-11-21 20:36:46 -08:00
uio uio: Add module.h to implicit drivers/uio users 2011-10-31 19:32:10 -04:00
usb Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2011-11-21 20:37:11 -08:00
uwb uwb: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required 2011-10-31 19:32:19 -04:00
vhost
video Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
virt
virtio virtio-pci: make reset operation safer 2011-11-24 13:04:48 +10:30
vlynq
w1 Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
watchdog watchdog: fix initialisation printout in s3c2410_wdt 2011-11-16 22:04:17 +01:00
xen xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX. 2012-01-04 17:02:03 -05:00
zorro drivers/zorro: Add export.h to proc.c 2011-10-31 19:32:01 -04:00
Kconfig Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 2011-10-26 15:39:02 +02:00
Makefile Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 2011-10-26 15:39:02 +02:00