Re: [PATCH 2/6] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()

2020-12-06 Thread Andrea Parri
On Sun, Dec 06, 2020 at 05:10:26PM +, Michael Kelley wrote: > From: Andrea Parri (Microsoft) Sent: Wednesday, > November 18, 2020 6:37 AM > > > > vmbus_on_msg_dpc() double fetches from msgtype. The double fetch can > > lead to an out-of-bound access when accessing the channel_message_table

RE: [PATCH 2/6] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()

2020-12-06 Thread Michael Kelley
From: Andrea Parri (Microsoft) Sent: Wednesday, November 18, 2020 6:37 AM > > vmbus_on_msg_dpc() double fetches from msgtype. The double fetch can > lead to an out-of-bound access when accessing the channel_message_table > array. In turn, the use of the out-of-bound entry could lead to code >

[PATCH 2/6] Drivers: hv: vmbus: Avoid double fetch of msgtype in vmbus_on_msg_dpc()

2020-11-18 Thread Andrea Parri (Microsoft)
vmbus_on_msg_dpc() double fetches from msgtype. The double fetch can lead to an out-of-bound access when accessing the channel_message_table array. In turn, the use of the out-of-bound entry could lead to code execution primitive (entry->message_handler()). Avoid the double fetch by saving the