Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-05 Thread Arnd Bergmann
On Mon, Feb 5, 2018 at 2:58 PM, David Laight wrote: > From: Arnd Bergmann >> Sent: 05 February 2018 12:37 > >> > Are the EVTCHNOP_xxx values dense? >> > In which case an array is almost certainly better than the switch >> > statement. >> >> They are, yes. PHYSDEVOP_xxx are also consecutive b

RE: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-05 Thread David Laight
From: Arnd Bergmann > Sent: 05 February 2018 12:37 > > Are the EVTCHNOP_xxx values dense? > > In which case an array is almost certainly better than the switch statement. > > They are, yes. PHYSDEVOP_xxx are also consecutive by start at '4'. > Dan made the same comment earlier, and I replied

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-05 Thread Arnd Bergmann
On Mon, Feb 5, 2018 at 1:11 PM, David Laight wrote: > From: Boris Ostrovsky >> Sent: 02 February 2018 23:34 > ... >> > switch (cmd) { >> > + case EVTCHNOP_bind_interdomain: >> > + len = sizeof(struct evtchn_bind_interdomain); >> > + break; >> > + case EVTCHNOP_bind_virq

RE: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-05 Thread David Laight
From: Boris Ostrovsky > Sent: 02 February 2018 23:34 ... > > switch (cmd) { > > + case EVTCHNOP_bind_interdomain: > > + len = sizeof(struct evtchn_bind_interdomain); > > + break; > > + case EVTCHNOP_bind_virq: > > + len = sizeof(struct evtchn_bind_virq); > > +

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-04 Thread Boris Ostrovsky
On 02/04/2018 10:35 AM, Arnd Bergmann wrote: On Sat, Feb 3, 2018 at 6:08 PM, Boris Ostrovsky wrote: On 02/03/2018 10:12 AM, Arnd Bergmann wrote: On Sat, Feb 3, 2018 at 12:33 AM, Boris Ostrovsky wrote: On 02/02/2018 10:32 AM, Arnd Bergmann wrote: The legacy hypercall handlers were origina

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-04 Thread Arnd Bergmann
On Sat, Feb 3, 2018 at 6:08 PM, Boris Ostrovsky wrote: > > > On 02/03/2018 10:12 AM, Arnd Bergmann wrote: >> >> On Sat, Feb 3, 2018 at 12:33 AM, Boris Ostrovsky >> wrote: >>> >>> On 02/02/2018 10:32 AM, Arnd Bergmann wrote: The legacy hypercall handlers were originally added with a

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-03 Thread Boris Ostrovsky
On 02/03/2018 10:12 AM, Arnd Bergmann wrote: On Sat, Feb 3, 2018 at 12:33 AM, Boris Ostrovsky wrote: On 02/02/2018 10:32 AM, Arnd Bergmann wrote: The legacy hypercall handlers were originally added with a comment explaining that "copying the argument structures in HYPERVISOR_event_channel_op

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-03 Thread Arnd Bergmann
On Sat, Feb 3, 2018 at 12:33 AM, Boris Ostrovsky wrote: > On 02/02/2018 10:32 AM, Arnd Bergmann wrote: >> The legacy hypercall handlers were originally added with >> a comment explaining that "copying the argument structures in >> HYPERVISOR_event_channel_op() and HYPERVISOR_physdev_op() into the

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-02 Thread Boris Ostrovsky
On 02/02/2018 10:32 AM, Arnd Bergmann wrote: > The legacy hypercall handlers were originally added with > a comment explaining that "copying the argument structures in > HYPERVISOR_event_channel_op() and HYPERVISOR_physdev_op() into the local > variable is sufficiently safe" and only made sure to n

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-02 Thread Dan Carpenter
On Fri, Feb 02, 2018 at 05:11:02PM +0100, Arnd Bergmann wrote: > On Fri, Feb 2, 2018 at 4:53 PM, Dan Carpenter > wrote: > > On Fri, Feb 02, 2018 at 04:32:31PM +0100, Arnd Bergmann wrote: > >> switch (cmd) { > >> + case EVTCHNOP_bind_interdomain: > >> + len = sizeof(struct ev

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-02 Thread Arnd Bergmann
On Fri, Feb 2, 2018 at 4:53 PM, Dan Carpenter wrote: > On Fri, Feb 02, 2018 at 04:32:31PM +0100, Arnd Bergmann wrote: >> --- a/drivers/xen/fallback.c >> +++ b/drivers/xen/fallback.c >> @@ -7,75 +7,87 @@ >> >> int xen_event_channel_op_compat(int cmd, void *arg) >> { >> - struct evtchn_op op;

Re: [PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-02 Thread Dan Carpenter
On Fri, Feb 02, 2018 at 04:32:31PM +0100, Arnd Bergmann wrote: > The legacy hypercall handlers were originally added with > a comment explaining that "copying the argument structures in > HYPERVISOR_event_channel_op() and HYPERVISOR_physdev_op() into the local > variable is sufficiently safe" and o

[PATCH] xen: hypercall: fix out-of-bounds memcpy

2018-02-02 Thread Arnd Bergmann
The legacy hypercall handlers were originally added with a comment explaining that "copying the argument structures in HYPERVISOR_event_channel_op() and HYPERVISOR_physdev_op() into the local variable is sufficiently safe" and only made sure to not write past the end of the argument structure, the