lkml.org 
[lkml]   [2022]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 82/98] xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses()
    Date
    From: Jan Beulich <jbeulich@suse.com>

    commit f63c2c2032c2e3caad9add3b82cc6e91c376fd26 upstream.

    The commit referenced below moved the invocation past the "next" label,
    without any explanation. In fact this allows misbehaving backends undue
    control over the domain the frontend runs in, as earlier detected errors
    require the skb to not be freed (it may be retained for later processing
    via xennet_move_rx_slot(), or it may simply be unsafe to have it freed).

    This is CVE-2022-33743 / XSA-405.

    Fixes: 6c5aa6fc4def ("xen networking: add basic XDP support for xen-netfront")
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/xen-netfront.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/net/xen-netfront.c
    +++ b/drivers/net/xen-netfront.c
    @@ -1094,8 +1094,10 @@ static int xennet_get_responses(struct n
    }
    }
    rcu_read_unlock();
    -next:
    +
    __skb_queue_tail(list, skb);
    +
    +next:
    if (!(rx->flags & XEN_NETRXF_more_data))
    break;


    \
     
     \ /
      Last update: 2022-07-05 14:31    [W:4.072 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site