This is a note to let you know that I've just added the patch titled
vhost: validate vhost_get_vq_desc return value
to the 3.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
vhost-validate-vhost_get_vq_desc-return-value.patch
and it can be found in the queue-3.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From foo@baz Thu Apr 10 22:03:04 PDT 2014
From: "Michael S. Tsirkin" <[email protected]>
Date: Thu, 27 Mar 2014 12:53:37 +0200
Subject: vhost: validate vhost_get_vq_desc return value
From: "Michael S. Tsirkin" <[email protected]>
[ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]
vhost fails to validate negative error code
from vhost_get_vq_desc causing
a crash: we are using -EFAULT which is 0xfffffff2
as vector size, which exceeds the allocated size.
The code in question was introduced in commit
8dd014adfea6f173c1ef6378f7e5e7924866c923
vhost-net: mergeable buffers support
CVE-2014-0055
Signed-off-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/vhost/net.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -501,9 +501,13 @@ static int get_rx_bufs(struct vhost_virt
r = -ENOBUFS;
goto err;
}
- d = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
+ r = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
ARRAY_SIZE(vq->iov) - seg, &out,
&in, log, log_num);
+ if (unlikely(r < 0))
+ goto err;
+
+ d = r;
if (d == vq->num) {
r = 0;
goto err;
Patches currently in stable-queue which might be from [email protected] are
queue-3.13/virtio-net-correct-error-handling-of-virtqueue_kick.patch
queue-3.13/skbuff-skb_segment-orphan-frags-before-copying.patch
queue-3.13/vhost-fix-total-length-when-packets-are-too-short.patch
queue-3.13/skbuff-skb_segment-s-frag-nskb_frag.patch
queue-3.13/skbuff-skb_segment-s-skb-head_skb.patch
queue-3.13/vhost-validate-vhost_get_vq_desc-return-value.patch
queue-3.13/skbuff-skb_segment-s-skb_frag-frag.patch
queue-3.13/skbuff-skb_segment-s-fskb-list_skb.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
