2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-16 09:13:55 +08:00
linux-next/drivers/xen/xenbus
Ian Campbell 9e7860cee1 xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.
Haogang Chen found out that:

 There is a potential integer overflow in process_msg() that could result
 in cross-domain attack.

 	body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);

 When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
 call to xb_read() would write to a zero-length buffer.

 The other end of this connection is always the xenstore backend daemon
 so there is no guest (malicious or otherwise) which can do this. The
 xenstore daemon is a trusted component in the system.

 However this seem like a reasonable robustness improvement so we should
 have it.

And Ian when read the API docs found that:
        The payload length (len field of the header) is limited to 4096
        (XENSTORE_PAYLOAD_MAX) in both directions.  If a client exceeds the
        limit, its xenstored connection will be immediately killed by
        xenstored, which is usually catastrophic from the client's point of
        view.  Clients (particularly domains, which cannot just reconnect)
        should avoid this.

so this patch checks against that instead.

This also avoids a potential integer overflow pointed out by Haogang Chen.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Haogang Chen <haogangchen@gmail.com>
CC: stable@kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2012-01-04 17:02:03 -05:00
..
Makefile xen: Add xenbus_backend device 2011-12-16 13:29:41 -05:00
xenbus_client.c xenbus: Use grant-table wrapper functions 2011-12-20 17:05:25 -05:00
xenbus_comms.c xen/pv-on-hvm kexec+kdump: reset PV devices in kexec or crash kernel 2011-09-01 11:49:03 -04:00
xenbus_comms.h xen: Add xenbus device driver 2011-12-16 13:29:39 -05:00
xenbus_dev_backend.c xen/xenbus: Fix compile error - missing header for xen_initial_domain() 2011-12-21 14:32:50 -05:00
xenbus_dev_frontend.c xen/xenbus-frontend: Fix compile error with randconfig 2011-12-20 10:47:44 -05:00
xenbus_probe_backend.c Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
xenbus_probe_frontend.c Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
xenbus_probe.c Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
xenbus_probe.h Xen: consolidate and simplify struct xenbus_driver instantiation 2012-01-04 17:01:17 -05:00
xenbus_xs.c xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX. 2012-01-04 17:02:03 -05:00