On Sun, Mar 17, 2013 at 02:29:55PM -0400, David Miller wrote: > From: "Michael S. Tsirkin" <mst@xxxxxxxxxx> > Date: Sun, 17 Mar 2013 14:46:09 +0200 > > > ubuf info allocator uses guest controlled head as an index, > > so a malicious guest could put the same head entry in the ring twice, > > and we will get two callbacks on the same value. > > To fix use upend_idx which is guaranteed to be unique. > > > > Reported-by: Rusty Russell <rusty@xxxxxxxxxxxxxxx> > > Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx> > > Applied and queued up for -stable, thanks. OK I'll drop it from my tree then. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
