hv_netvsc: Add range checking for rx packet offset and length
authorHaiyang Zhang <haiyangz@microsoft.com>
Thu, 22 Mar 2018 19:01:14 +0000 (12:01 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sun, 25 Mar 2018 21:07:40 +0000 (17:07 -0400)
This patch adds range checking for rx packet offset and length.
It may only happen if there is a host side bug.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/hyperv/hyperv_net.h
drivers/net/hyperv/netvsc.c

index 32861036c3fcc9ec9e34938e0f916198307b419c..960f061414722e50043c3a71d33757e737507a88 100644 (file)
@@ -793,6 +793,7 @@ struct netvsc_device {
 
        /* Receive buffer allocated by us but manages by NetVSP */
        void *recv_buf;
+       u32 recv_buf_size; /* allocated bytes */
        u32 recv_buf_gpadl_handle;
        u32 recv_section_cnt;
        u32 recv_section_size;
index 58bb2dcbc9f04b9563486d449248b1ec3cbab25d..c9910c33e671f3f161f83249491d63e557274bbf 100644 (file)
@@ -282,6 +282,8 @@ static int netvsc_init_buf(struct hv_device *device,
                goto cleanup;
        }
 
+       net_device->recv_buf_size = buf_size;
+
        /*
         * Establish the gpadl handle for this buffer on this
         * channel.  Note: This call uses the vmbus connection rather
@@ -1095,11 +1097,22 @@ static int netvsc_receive(struct net_device *ndev,
 
        /* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */
        for (i = 0; i < count; i++) {
-               void *data = recv_buf
-                       + vmxferpage_packet->ranges[i].byte_offset;
+               u32 offset = vmxferpage_packet->ranges[i].byte_offset;
                u32 buflen = vmxferpage_packet->ranges[i].byte_count;
+               void *data;
                int ret;
 
+               if (unlikely(offset + buflen > net_device->recv_buf_size)) {
+                       status = NVSP_STAT_FAIL;
+                       netif_err(net_device_ctx, rx_err, ndev,
+                                 "Packet offset:%u + len:%u too big\n",
+                                 offset, buflen);
+
+                       continue;
+               }
+
+               data = recv_buf + offset;
+
                trace_rndis_recv(ndev, q_idx, data);
 
                /* Pass it to the upper layer */