korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-03 17:14:14 +08:00
Code Issues Packages Projects Releases Wiki Activity
7fbe078c37
linux/drivers
History
Zha Bin 7fbe078c37 vhost/vsock: fix vhost vsock cid hashing inconsistent 
The vsock core only supports 32bit CID, but the Virtio-vsock spec define
CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as
zero. This inconsistency causes one bug in vhost vsock driver. The
scenarios is:

  0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock
  object. And hash_min() is used to compute the hash key. hash_min() is
  defined as:
  (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)).
  That means the hash algorithm has dependency on the size of macro
  argument 'val'.
  0. In function vhost_vsock_set_cid(), a 64bit CID is passed to
  hash_min() to compute the hash key when inserting a vsock object into
  the hash table.
  0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min()
  to compute the hash key when looking up a vsock for an CID.

Because the different size of the CID, hash_min() returns different hash
key, thus fails to look up the vsock object for an CID.

To fix this bug, we keep CID as u64 in the IOCTLs and virtio message
headers, but explicitly convert u64 to u32 when deal with the hash table
and vsock core.

Fixes: 834e772c8d ("vhost/vsock: fix use-after-free in network stack callers")
Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex
Signed-off-by: Zha Bin <zhabin@linux.alibaba.com>
Reviewed-by: Liu Jiang <gerry@linux.alibaba.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-01-11 17:48:11 -08:00
..
accessibility
acpi Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
amba
android binder: implement binderfs 2018-12-19 09:40:13 +01:00
ata for-4.21/libata-20190102 2019-01-02 18:47:56 -08:00
atm
auxdisplay auxdisplay: charlcd: fix x/y command parsing 2018-12-21 21:27:21 +01:00
base Device properties framework fixes for 4.21-rc1 2019-01-02 18:43:57 -08:00
bcma
block virtio, vhost: features, fixes, cleanups 2019-01-02 18:54:45 -08:00
bluetooth Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading 2018-12-19 13:43:42 +01:00
bus ARM: SoC driver updates 2018-12-31 17:32:35 -08:00
cdrom gdrom: fix a memory leak bug 2018-12-29 08:20:44 -07:00
char Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
clk Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2019-01-02 18:56:59 -08:00
clocksource Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-12-25 15:44:08 -08:00
connector
cpufreq powerpc updates for 4.21 2018-12-27 10:43:24 -08:00
cpuidle powerpc updates for 4.21 2018-12-27 10:43:24 -08:00
crypto Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
dax mm, devm_memremap_pages: fix shutdown handling 2018-12-28 12:11:47 -08:00
dca
devfreq
dio
dma IOMMU Updates for Linux v4.21 2019-01-01 15:55:29 -08:00
dma-buf
edac EDAC, fsl_ddr: Add LS1021A to the list of supported hardware 2018-12-19 11:57:45 +01:00
eisa
extcon
firewire Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
firmware Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
fmc
fpga Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
fsi
gnss
gpio This is the bulk of GPIO changes for the v4.21 kernel series: 2018-12-28 20:00:21 -08:00
gpu Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
hid This is the bulk of GPIO changes for the v4.21 kernel series: 2018-12-28 20:00:21 -08:00
hsi
hv Char/Misc driver patches for 4.21-rc1 2018-12-28 20:54:57 -08:00
hwmon Kconfig updates for v4.21 2018-12-29 13:03:29 -08:00
hwspinlock
hwtracing intel_th: msu: Fix an off-by-one in attribute store 2018-12-19 20:21:06 +01:00
i2c Kconfig updates for v4.21 2018-12-29 13:03:29 -08:00
i3c
ide for-4.21/block-20181221 2018-12-28 13:19:59 -08:00
idle
iio Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
infiniband Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2019-01-02 18:56:59 -08:00
iommu IOMMU Updates for Linux v4.21 2019-01-01 15:55:29 -08:00
ipack
irqchip Xtensa updates for v4.21: 2018-12-29 09:40:40 -08:00
isdn isdn: fix kernel-infoleak in capi_unlocked_ioctl 2019-01-02 10:31:39 -08:00
leds LEDs for 4.21-rc1 2018-12-25 14:52:50 -08:00
lightnvm lightnvm: pblk: fix use-after-free bug 2018-12-22 14:45:35 -07:00
macintosh Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
mailbox mailbox: tegra-hsp: Use device-managed registration API 2018-12-21 22:31:26 -06:00
mcb
md Merge branch 'akpm' (patches from Andrew) 2018-12-28 16:55:46 -08:00
media Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
memory ARM: SoC driver updates 2018-12-31 17:32:35 -08:00
memstick MMC core: 2018-12-28 16:52:18 -08:00
message scsi: flip the default on use_clustering 2018-12-18 23:13:12 -05:00
mfd
misc Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
mmc MMC core: 2018-12-28 16:52:18 -08:00
mtd Kbuild updates for v4.21 2018-12-29 12:03:17 -08:00
mux
net net: stmmac: Prevent RX starvation in stmmac_napi_poll() 2019-01-11 15:35:06 -08:00
nfc
ntb
nubus
nvdimm Merge branch 'akpm' (patches from Andrew) 2018-12-28 16:55:46 -08:00
nvme nvme-pci: trace SQ status on completions 2018-12-19 08:35:36 +01:00
nvmem
of Merge tag 'devicetree-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux 2018-12-28 20:08:34 -08:00
opp
oprofile
parisc Kconfig file consolidation for v4.21 2018-12-29 13:40:29 -08:00
parport
pci Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
pcmcia
perf
phy phy: ti: Fix compilation failures without REGMAP 2019-01-07 14:21:37 -05:00
pinctrl Pin control bulk changes for the v4.21 kernel cycle: 2019-01-01 13:19:16 -08:00
platform Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
pnp Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
power power supply and reset changes for the v4.21 series 2018-12-28 20:22:45 -08:00
powercap
pps Kconfig updates for v4.21 2018-12-29 13:03:29 -08:00
ps3
ptp ptp: check that rsv field is zero in struct ptp_sys_offset_extended 2019-01-08 16:22:56 -05:00
pwm pwm: imx: Add ipg clock operation 2018-12-24 12:06:56 +01:00
rapidio
ras treewide: surround Kconfig file paths with double quotes 2018-12-22 00:25:54 +09:00
regulator Merge remote-tracking branch 'regulator/topic/coupled' into regulator-next 2018-12-21 13:43:35 +00:00
remoteproc
reset
rpmsg
rtc RTC for 4.21 2019-01-01 13:24:31 -08:00
s390 s390 updates for the 4.21 merge window 2019-01-02 18:37:01 -08:00
sbus Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next 2018-12-26 10:32:18 -08:00
scsi Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
sfi
sh
siox
slimbus
sn
soc soc/fsl/qe: fix err handling of ucc_of_parse_tdm 2019-01-04 12:50:43 -08:00
soundwire
spi spi: Updates for v4.21 2018-12-25 14:43:54 -08:00
spmi
ssb
staging Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
target SCSI misc on 20181224 2018-12-28 14:48:06 -08:00
tc
tee
thermal Kconfig updates for v4.21 2018-12-29 13:03:29 -08:00
thunderbolt
tty Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
uio Char/Misc driver patches for 4.21-rc1 2018-12-28 20:54:57 -08:00
usb Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
uwb
vfio IOMMU Updates for Linux v4.21 2019-01-01 15:55:29 -08:00
vhost vhost/vsock: fix vhost vsock cid hashing inconsistent 2019-01-11 17:48:11 -08:00
video Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
virt
virtio virtio, vhost: features, fixes, cleanups 2019-01-02 18:54:45 -08:00
visorbus
vlynq
vme
w1 treewide: surround Kconfig file paths with double quotes 2018-12-22 00:25:54 +09:00
watchdog linux-watchdog 4.21-rc1 tag 2019-01-01 13:16:45 -08:00
xen Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
zorro
Kconfig Kconfig file consolidation for v4.21 2018-12-29 13:40:29 -08:00
Makefile