Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Ben Hutchings
On Thu, 2013-03-21 at 18:28 +0200, Michael S. Tsirkin wrote: > On Thu, Mar 21, 2013 at 04:23:48PM +, Ben Hutchings wrote: > > On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: > > > On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > > > > From: "Michael S. Tsirkin" > >

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Michael S. Tsirkin
On Thu, Mar 21, 2013 at 04:23:48PM +, Ben Hutchings wrote: > On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: > > On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > > > From: "Michael S. Tsirkin" > > > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > > > > > ubuf info

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Ben Hutchings
On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: > On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > > From: "Michael S. Tsirkin" > > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > > > ubuf info allocator uses guest controlled head as an index, > > > so a malicious guest

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Michael S. Tsirkin
On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > From: "Michael S. Tsirkin" > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > ubuf info allocator uses guest controlled head as an index, > > so a malicious guest could put the same head entry in the ring twice, > > and we will get two

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Michael S. Tsirkin
On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: From: Michael S. Tsirkin m...@redhat.com Date: Sun, 17 Mar 2013 14:46:09 +0200 ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Ben Hutchings
On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: From: Michael S. Tsirkin m...@redhat.com Date: Sun, 17 Mar 2013 14:46:09 +0200 ubuf info allocator uses guest controlled head as an index, so a malicious guest

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Michael S. Tsirkin
On Thu, Mar 21, 2013 at 04:23:48PM +, Ben Hutchings wrote: On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: From: Michael S. Tsirkin m...@redhat.com Date: Sun, 17 Mar 2013 14:46:09 +0200 ubuf info

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-21 Thread Ben Hutchings
On Thu, 2013-03-21 at 18:28 +0200, Michael S. Tsirkin wrote: On Thu, Mar 21, 2013 at 04:23:48PM +, Ben Hutchings wrote: On Thu, 2013-03-21 at 08:02 +0200, Michael S. Tsirkin wrote: On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: From: Michael S. Tsirkin m...@redhat.com

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread Michael S. Tsirkin
On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > From: "Michael S. Tsirkin" > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > ubuf info allocator uses guest controlled head as an index, > > so a malicious guest could put the same head entry in the ring twice, > > and we will get two

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread David Miller
From: "Michael S. Tsirkin" Date: Sun, 17 Mar 2013 14:46:09 +0200 > ubuf info allocator uses guest controlled head as an index, > so a malicious guest could put the same head entry in the ring twice, > and we will get two callbacks on the same value. > To fix use upend_idx which is guaranteed to

[PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread Michael S. Tsirkin
ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value. To fix use upend_idx which is guaranteed to be unique. Reported-by: Rusty Russell Signed-off-by: Michael S. Tsirkin

[PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread Michael S. Tsirkin
ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value. To fix use upend_idx which is guaranteed to be unique. Reported-by: Rusty Russell ru...@rustcorp.com.au Signed-off-by:

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread David Miller
From: Michael S. Tsirkin m...@redhat.com Date: Sun, 17 Mar 2013 14:46:09 +0200 ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value. To fix use upend_idx which is

Re: [PATCH net] vhost/net: fix heads usage of ubuf_info

2013-03-17 Thread Michael S. Tsirkin
On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: From: Michael S. Tsirkin m...@redhat.com Date: Sun, 17 Mar 2013 14:46:09 +0200 ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get