Jan Beulich 309a1c5cfc xen-netback: fix input validation in xenvif_set_hash_mapping() ... commit 780e83c259 upstream. Both len and off are frontend specified values, so we need to make sure there's no overflow when adding the two for the bounds check. We also want to avoid undefined behavior and hence use off to index into ->hash.mapping[] only after bounds checking. This at the same time allows to take care of not applying off twice for the bounds checking against vif->num_queues. It is also insufficient to bounds check copy_op.len, as this is len truncated to 16 bits. This is XSA-270 / CVE-2018-15471. Reported-by: Felix Wilhelm <fwilhelm@google.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Tested-by: Paul Durrant <paul.durrant@citrix.com> Cc: stable@vger.kernel.org [4.7 onwards] Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-10-13 09:27:23 +02:00
..
Makefile	xen-netback: separate guest side rx code into separate module	2016-10-06 20:37:35 -04:00
common.h	xen-netback: correctly schedule rate-limited queues	2017-06-22 11:15:42 -04:00
hash.c	xen-netback: fix input validation in xenvif_set_hash_mapping()	2018-10-13 09:27:23 +02:00
interface.c	xen-netfront, xen-netback: Use correct minimum MTU values	2017-10-16 16:00:44 -04:00
netback.c	xen-netback: correctly schedule rate-limited queues	2017-06-22 11:15:42 -04:00
rx.c	xen-netback: fix type mismatch warning	2016-10-13 11:02:25 -04:00
xenbus.c	xen-netback: fix race condition on XenBus disconnect	2017-03-12 23:44:43 -07:00