Re: [PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()

2020-12-06 Thread Andrea Parri
On Sun, Dec 06, 2020 at 05:14:18PM +, Michael Kelley wrote: > From: Andrea Parri (Microsoft) Sent: Wednesday, > November 18, 2020 6:37 AM > > > > vmbus_on_msg_dpc() double fetches from payload_size. The double fetch > > can lead to a buffer overflow when (mem)copying the hv_message object.

RE: [PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()

2020-12-06 Thread Michael Kelley
From: Andrea Parri (Microsoft) Sent: Wednesday, November 18, 2020 6:37 AM > > vmbus_on_msg_dpc() double fetches from payload_size. The double fetch > can lead to a buffer overflow when (mem)copying the hv_message object. > Avoid the double fetch by saving the value of payload_size into a local

[PATCH 3/6] Drivers: hv: vmbus: Avoid double fetch of payload_size in vmbus_on_msg_dpc()

2020-11-18 Thread Andrea Parri (Microsoft)
vmbus_on_msg_dpc() double fetches from payload_size. The double fetch can lead to a buffer overflow when (mem)copying the hv_message object. Avoid the double fetch by saving the value of payload_size into a local variable. Reported-by: Juan Vazquez Signed-off-by: Andrea Parri (Microsoft) ---