linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-08 22:52:35 +02:00

Linux kernel source tree

Go to file

Jason Wang aafe74b726 vhost: fix OOB in get_rx_bufs() [ Upstream commit `b46a0bf78a` ] After batched used ring updating was introduced in commit `e2b3b35eb9` ("vhost_net: batch used ring update in rx"). We tend to batch heads in vq->heads for more than one packet. But the quota passed to get_rx_bufs() was not correctly limited, which can result a OOB write in vq->heads. headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx, vhost_len, &in, vq_log, &log, likely(mergeable) ? UIO_MAXIOV : 1); UIO_MAXIOV was still used which is wrong since we could have batched used in vq->heads, this will cause OOB if the next buffer needs more than 960 (1024 (UIO_MAXIOV) - 64 (VHOST_NET_BATCH)) heads after we've batched 64 (VHOST_NET_BATCH) heads: Acked-by: Stefan Hajnoczi <stefanha@redhat.com> ============================================================================= BUG kmalloc-8k (Tainted: G B ): Redzone overwritten ----------------------------------------------------------------------------- INFO: 0x00000000fd93b7a2-0x00000000f0713384. First byte 0xa9 instead of 0xcc INFO: Allocated in alloc_pd+0x22/0x60 age=3933677 cpu=2 pid=2674 kmem_cache_alloc_trace+0xbb/0x140 alloc_pd+0x22/0x60 gen8_ppgtt_create+0x11d/0x5f0 i915_ppgtt_create+0x16/0x80 i915_gem_create_context+0x248/0x390 i915_gem_context_create_ioctl+0x4b/0xe0 drm_ioctl_kernel+0xa5/0xf0 drm_ioctl+0x2ed/0x3a0 do_vfs_ioctl+0x9f/0x620 ksys_ioctl+0x6b/0x80 __x64_sys_ioctl+0x11/0x20 do_syscall_64+0x43/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 INFO: Slab 0x00000000d13e87af objects=3 used=3 fp=0x (null) flags=0x200000000010201 INFO: Object 0x0000000003278802 @offset=17064 fp=0x00000000e2e6652b Fixing this by allocating UIO_MAXIOV + VHOST_NET_BATCH iovs for vhost-net. This is done through set the limitation through vhost_dev_init(), then set_owner can allocate the number of iov in a per device manner. This fixes CVE-2018-16880. Fixes: `e2b3b35eb9` ("vhost_net: batch used ring update in rx") Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-02-06 17:30:08 +01:00
arch	s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU	2019-01-31 08:14:41 +01:00
block	block: use rcu_work instead of call_rcu to avoid sleep in softirq	2019-01-22 21:40:35 +01:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: ecc - regularize scalar for scalar multiplication	2019-01-26 09:32:35 +01:00
Documentation	mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps	2019-01-26 09:32:44 +01:00
drivers	vhost: fix OOB in get_rx_bufs()	2019-02-06 17:30:08 +01:00
firmware	kbuild: remove all dummy assignments to obj-	2017-11-18 11:46:06 +09:00
fs	smb3: add credits we receive from oplock/break PDUs	2019-01-31 08:14:37 +01:00
include	ipvlan, l3mdev: fix broken l3s mode wrt local routes	2019-02-06 17:30:06 +01:00
init	kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7	2019-01-22 21:40:34 +01:00
ipc	ipc/shm.c: use ERR_CAST() for shm_lock() error return	2018-10-05 16:32:04 -07:00
kernel	bpf: fix inner map masking to prevent oob under speculation	2019-01-31 08:14:41 +01:00
lib	fix int_sqrt64() for very large numbers	2019-01-22 21:40:34 +01:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	Revert "mm, memory_hotplug: initialize struct pages for the full memory section"	2019-01-31 08:14:41 +01:00
net	sctp: improve the events for sctp stream reset	2019-02-06 17:30:07 +01:00
samples	samples: bpf: fix: error handling regarding kprobe_events	2019-01-26 09:32:35 +01:00
scripts	kconfig: fix memory leak when EOF is encountered in quotation	2019-01-26 09:32:39 +01:00
security	selinux: always allow mounting submounts	2019-01-26 09:32:36 +01:00
sound	ALSA: hda - Add mute LED support for HP ProBook 470 G5	2019-01-31 08:14:35 +01:00
tools	x86/selftests/pkeys: Fork() to check for state being preserved	2019-01-31 08:14:39 +01:00
usr	initramfs: move gen_initramfs_list.sh from scripts/ to usr/	2018-08-22 23:21:44 +09:00
virt	KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less	2019-01-16 22:04:37 +01:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	MAINTAINERS: Add Sasha as a stable branch maintainer	2018-12-01 09:37:25 +01:00
Makefile	Linux 4.19.19	2019-01-31 08:14:42 +01:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.