iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Drivers: hv: vmbus: Initialize unload_event statically

Browse Source 
If a malicious or compromised Hyper-V sends a spurious message of type
CHANNELMSG_UNLOAD_RESPONSE, the function vmbus_unload_response() will
call complete() on an uninitialized event, and cause an oops.

Reported-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20210420014350.2002-1-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
This commit is contained in:
Andrea Parri (Microsoft) 2021-04-20 03:43:50 +02:00 committed by Wei Liu
parent b635ccc1ec
commit 8c2d5e0640
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/hv/channel_mgmt.c
View File

@ -826,6 +826,11 @@ static void vmbus_unload_response(struct vmbus_channel_message_header *hdr)
/*
* This is a global event; just wakeup the waiting thread.
* Once we successfully unload, we can cleanup the monitor state.
*
* NB. A malicious or compromised Hyper-V could send a spurious
* message of type CHANNELMSG_UNLOAD_RESPONSE, and trigger a call
* of the complete() below. Make sure that unload_event has been
* initialized by the time this complete() is executed.
*/
complete(&vmbus_connection.unload_event);
}
@ -841,7 +846,7 @@ void vmbus_initiate_unload(bool crash)
if (vmbus_proto_version < VERSION_WIN8_1)
return;
init_completion(&vmbus_connection.unload_event);
reinit_completion(&vmbus_connection.unload_event);
memset(&hdr, 0, sizeof(struct vmbus_channel_message_header));
hdr.msgtype = CHANNELMSG_UNLOAD;
vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header),

2
drivers/hv/connection.c
View File

@ -26,6 +26,8 @@
struct vmbus_connection vmbus_connection = {
.conn_state = DISCONNECTED,
.unload_event = COMPLETION_INITIALIZER(
vmbus_connection.unload_event),
.next_gpadl_handle = ATOMIC_INIT(0xE1E10),
.ready_for_suspend_event = COMPLETION_INITIALIZER(