From 5c807005fa60deef2db6616d9b7b24fc4c436be9 Mon Sep 17 00:00:00 2001 From: Wei Liu Date: Tue, 12 Aug 2014 11:59:29 +0100 Subject: [PATCH 1/2] xen-netback: fix debugfs write length check Enlarge buffer size and check input length properly, so that we don't misuse -ENOSPC. Note that command like "kickXXXX" is still allowed, that's one patch for another day if we really want to be very strict on this. Reported-by: SeeChen Ng Signed-off-by: Wei Liu Cc: Zoltan Kiss Cc: Ian Campbell Signed-off-by: David S. Miller --- drivers/net/xen-netback/xenbus.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c index 580517d857bf7..4c9041e60e7d9 100644 --- a/drivers/net/xen-netback/xenbus.c +++ b/drivers/net/xen-netback/xenbus.c @@ -116,6 +116,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v) } #define XENVIF_KICK_STR "kick" +#define BUFFER_SIZE 32 static ssize_t xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count, @@ -124,22 +125,24 @@ xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count, struct xenvif_queue *queue = ((struct seq_file *)filp->private_data)->private; int len; - char write[sizeof(XENVIF_KICK_STR)]; + char write[BUFFER_SIZE]; /* don't allow partial writes and check the length */ if (*ppos != 0) return 0; - if (count < sizeof(XENVIF_KICK_STR) - 1) + if (count >= sizeof(write)) return -ENOSPC; len = simple_write_to_buffer(write, - sizeof(write), + sizeof(write) - 1, ppos, buf, count); if (len < 0) return len; + write[len] = '\0'; + if (!strncmp(write, XENVIF_KICK_STR, sizeof(XENVIF_KICK_STR) - 1)) xenvif_interrupt(0, (void *)queue); else { From 628fa76b09d7b0923c142631fc25b6affbfb868d Mon Sep 17 00:00:00 2001 From: Wei Liu Date: Tue, 12 Aug 2014 11:59:30 +0100 Subject: [PATCH 2/2] xen-netback: fix debugfs entry creation The original code is bogus. The function gets called in a loop which leaks entries created in previous rounds. Signed-off-by: Wei Liu Cc: Zoltan Kiss Cc: Ian Campbell Signed-off-by: David S. Miller --- drivers/net/xen-netback/xenbus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c index 4c9041e60e7d9..9c47b897b6d21 100644 --- a/drivers/net/xen-netback/xenbus.c +++ b/drivers/net/xen-netback/xenbus.c @@ -174,10 +174,9 @@ static const struct file_operations xenvif_dbg_io_ring_ops_fops = { .write = xenvif_write_io_ring, }; -static void xenvif_debugfs_addif(struct xenvif_queue *queue) +static void xenvif_debugfs_addif(struct xenvif *vif) { struct dentry *pfile; - struct xenvif *vif = queue->vif; int i; if (IS_ERR_OR_NULL(xen_netback_dbg_root)) @@ -736,10 +735,11 @@ static void connect(struct backend_info *be) be->vif->num_queues = queue_index; goto err; } + } + #ifdef CONFIG_DEBUG_FS - xenvif_debugfs_addif(queue); + xenvif_debugfs_addif(be->vif); #endif /* CONFIG_DEBUG_FS */ - } /* Initialisation completed, tell core driver the number of * active queues.