|
Olaf Hering |
873d14 |
From: "Andrea Parri (Microsoft)" <parri.andrea@gmail.com>
|
|
Olaf Hering |
873d14 |
Date: Tue, 20 Apr 2021 03:43:50 +0200
|
|
Olaf Hering |
873d14 |
Patch-mainline: v5.13-rc1
|
|
Olaf Hering |
873d14 |
Subject: Drivers: hv: vmbus: Initialize unload_event statically
|
|
Olaf Hering |
873d14 |
Git-commit: 8c2d5e0640e53c14b6240e9bf1e32a2226e6e6ca
|
|
Olaf Hering |
873d14 |
References: bsc#1185724
|
|
Olaf Hering |
873d14 |
|
|
Olaf Hering |
873d14 |
If a malicious or compromised Hyper-V sends a spurious message of type
|
|
Olaf Hering |
873d14 |
CHANNELMSG_UNLOAD_RESPONSE, the function vmbus_unload_response() will
|
|
Olaf Hering |
873d14 |
call complete() on an uninitialized event, and cause an oops.
|
|
Olaf Hering |
873d14 |
|
|
Olaf Hering |
873d14 |
Reported-by: Michael Kelley <mikelley@microsoft.com>
|
|
Olaf Hering |
873d14 |
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
|
|
Olaf Hering |
873d14 |
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
|
|
Olaf Hering |
873d14 |
Link: https://lore.kernel.org/r/20210420014350.2002-1-parri.andrea@gmail.com
|
|
Olaf Hering |
873d14 |
Signed-off-by: Wei Liu <wei.liu@kernel.org>
|
|
Olaf Hering |
873d14 |
Acked-by: Olaf Hering <ohering@suse.de>
|
|
Olaf Hering |
873d14 |
---
|
|
Olaf Hering |
873d14 |
drivers/hv/channel_mgmt.c | 7 ++++++-
|
|
Olaf Hering |
873d14 |
drivers/hv/connection.c | 2 ++
|
|
Olaf Hering |
873d14 |
2 files changed, 8 insertions(+), 1 deletion(-)
|
|
Olaf Hering |
873d14 |
|
|
Olaf Hering |
873d14 |
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
|
|
Olaf Hering |
873d14 |
--- a/drivers/hv/channel_mgmt.c
|
|
Olaf Hering |
873d14 |
+++ b/drivers/hv/channel_mgmt.c
|
|
Olaf Hering |
873d14 |
@@ -826,6 +826,11 @@ static void vmbus_unload_response(struct vmbus_channel_message_header *hdr)
|
|
Olaf Hering |
873d14 |
/*
|
|
Olaf Hering |
873d14 |
* This is a global event; just wakeup the waiting thread.
|
|
Olaf Hering |
873d14 |
* Once we successfully unload, we can cleanup the monitor state.
|
|
Olaf Hering |
873d14 |
+ *
|
|
Olaf Hering |
873d14 |
+ * NB. A malicious or compromised Hyper-V could send a spurious
|
|
Olaf Hering |
873d14 |
+ * message of type CHANNELMSG_UNLOAD_RESPONSE, and trigger a call
|
|
Olaf Hering |
873d14 |
+ * of the complete() below. Make sure that unload_event has been
|
|
Olaf Hering |
873d14 |
+ * initialized by the time this complete() is executed.
|
|
Olaf Hering |
873d14 |
*/
|
|
Olaf Hering |
873d14 |
complete(&vmbus_connection.unload_event);
|
|
Olaf Hering |
873d14 |
}
|
|
Olaf Hering |
873d14 |
@@ -841,7 +846,7 @@ void vmbus_initiate_unload(bool crash)
|
|
Olaf Hering |
873d14 |
if (vmbus_proto_version < VERSION_WIN8_1)
|
|
Olaf Hering |
873d14 |
return;
|
|
Olaf Hering |
873d14 |
|
|
Olaf Hering |
873d14 |
- init_completion(&vmbus_connection.unload_event);
|
|
Olaf Hering |
873d14 |
+ reinit_completion(&vmbus_connection.unload_event);
|
|
Olaf Hering |
873d14 |
memset(&hdr, 0, sizeof(struct vmbus_channel_message_header));
|
|
Olaf Hering |
873d14 |
hdr.msgtype = CHANNELMSG_UNLOAD;
|
|
Olaf Hering |
873d14 |
vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header),
|
|
Olaf Hering |
873d14 |
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
|
|
Olaf Hering |
873d14 |
--- a/drivers/hv/connection.c
|
|
Olaf Hering |
873d14 |
+++ b/drivers/hv/connection.c
|
|
Olaf Hering |
873d14 |
@@ -26,6 +26,8 @@
|
|
Olaf Hering |
873d14 |
|
|
Olaf Hering |
873d14 |
struct vmbus_connection vmbus_connection = {
|
|
Olaf Hering |
873d14 |
.conn_state = DISCONNECTED,
|
|
Olaf Hering |
873d14 |
+ .unload_event = COMPLETION_INITIALIZER(
|
|
Olaf Hering |
873d14 |
+ vmbus_connection.unload_event),
|
|
Olaf Hering |
873d14 |
.next_gpadl_handle = ATOMIC_INIT(0xE1E10),
|
|
Olaf Hering |
873d14 |
};
|
|
Olaf Hering |
873d14 |
EXPORT_SYMBOL_GPL(vmbus_connection);
|