Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()

An erroneous or malicious host could send multiple rescind messages for
a same channel.  In vmbus_onoffer_rescind(), the guest maps the channel
ID to obtain a pointer to the channel object and it eventually releases
such object and associated data.  The host could time rescind messages
and lead to an use-after-free.  Add a new flag to the channel structure
to make sure that only one instance of vmbus_onoffer_rescind() can get
the reference to the channel object.

Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20201209070827.29335-6-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>

This commit is contained in:

Andrea Parri (Microsoft)

2020-12-09 08:08:26 +01:00

committed by

Wei Liu

parent e3fa4b747f

commit e4d221b423

2 changed files with 13 additions and 0 deletions

									
										include/linux/hyperv.h
									
		+1
		
												View File
												
				@@ -809,6 +809,7 @@ struct vmbus_channel {

					u8 monitor_bit;

					bool rescind; /* got rescind msg */

					bool rescind_ref; /* got rescind msg, got channel reference */

					struct completion rescind_event;

					u32 ringbuffer_gpadlhandle;