Ian Campbell 9919fe804d xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX. ... commit 9e7860cee1 upstream. Haogang Chen found out that: There is a potential integer overflow in process_msg() that could result in cross-domain attack. body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH); When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent call to xb_read() would write to a zero-length buffer. The other end of this connection is always the xenstore backend daemon so there is no guest (malicious or otherwise) which can do this. The xenstore daemon is a trusted component in the system. However this seem like a reasonable robustness improvement so we should have it. And Ian when read the API docs found that: The payload length (len field of the header) is limited to 4096 (XENSTORE_PAYLOAD_MAX) in both directions. If a client exceeds the limit, its xenstored connection will be immediately killed by xenstored, which is usually catastrophic from the client's point of view. Clients (particularly domains, which cannot just reconnect) should avoid this. so this patch checks against that instead. This also avoids a potential integer overflow pointed out by Haogang Chen. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Cc: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2012-01-25 17:24:41 -08:00
..
acpi	Merge branches 'd3cold', 'bugzilla-37412' and 'bugzilla-38152' into release	2011-07-14 00:16:38 -04:00
asm-generic	Merge branches 'gpio/merge' and 'spi/merge' of git://git.secretlab.ca/git/linux-2.6	2011-06-17 10:36:32 -07:00
crypto
drm	drm/radeon/kms: add some new pci ids	2011-12-21 12:57:45 -08:00
keys
linux	PCI: Fix PCI_EXP_TYPE_RC_EC value	2012-01-25 17:24:38 -08:00
math-emu
media	[media] tuner-core/v4l2-subdev: document that the type field has to be filled in	2011-07-07 15:04:23 -03:00
mtd
net	sctp: fix incorrect overflow check on autoclose	2012-01-06 14:14:08 -08:00
pcmcia
rdma	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband	2011-05-26 12:13:57 -07:00
rxrpc
scsi	[SCSI] libsas: Add option for SATA soft reset	2011-05-26 22:49:33 -05:00
sound	ALSA: sb16 - Fix build errors on MIPS and others with 13bit ioctl size	2011-06-30 15:33:57 +02:00
target	[SCSI] target: Convert REPORT_LUNs to use int_to_scsilun	2011-05-24 13:02:42 -04:00
trace	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4	2011-06-21 10:22:35 -07:00
video	Merge branches 'common/fbdev' and 'common/fbdev-meram' of master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6	2011-05-24 15:49:57 +09:00
xen	xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.	2012-01-25 17:24:41 -08:00
Kbuild