Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-Id: <5A7882EA02000078001A552D@prv-mh.provo.novell.com>
Date:   Mon, 05 Feb 2018 08:14:34 -0700
From:   "Jan Beulich" <JBeulich@suse.com>
To:     "Arnd Bergmann" <arnd@arndb.de>
Cc:     "David Laight" <David.Laight@aculab.com>,
        <xen-devel@lists.xenproject.org>,
        "Boris Ostrovsky" <boris.ostrovsky@oracle.com>,
        "Dan Carpenter" <dan.carpenter@oracle.com>,
        "Juergen Gross" <jgross@suse.com>, <linux-kernel@vger.kernel.org>
Subject: Re: [Xen-devel] [PATCH] [v2] xen: hypercall: fix out-of-bounds
 memcpy
References: <20180205150340.328921-1-arnd@arndb.de>
In-Reply-To: <20180205150340.328921-1-arnd@arndb.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8BIT
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

>>> On 05.02.18 at 16:03, <arnd@arndb.de> wrote:
>  int xen_event_channel_op_compat(int cmd, void *arg)
>  {
> -	struct evtchn_op op;
> +	struct evtchn_op op = { .cmd = cmd, };
> +	size_t len;
>  	int rc;
>  
> -	op.cmd = cmd;
> -	memcpy(&op.u, arg, sizeof(op.u));
> -	rc = _hypercall1(int, event_channel_op_compat, &op);
> -
> -	switch (cmd) {
> -	case EVTCHNOP_close:
> -	case EVTCHNOP_send:
> -	case EVTCHNOP_bind_vcpu:
> -	case EVTCHNOP_unmask:
> -		/* no output */
> -		break;
> +	if (cmd > ARRAY_SIZE(evtchnop_len))
> +		return -ENOSYS;

>= perhaps?

Jan