diff options
| author | Andrea Parri (Microsoft) <parri.andrea@gmail.com> | 2021-02-03 14:35:12 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-02-05 07:37:04 +0300 |
| commit | 0102eeedb71757d6589144cf019424f69b3ab289 (patch) | |
| tree | e23732006cef5b76202b670aaf5887b0b9a29e71 /drivers | |
| parent | 6b4950d9501e80ad09060e9e5afb3ca3d12ba65e (diff) | |
| download | linux-0102eeedb71757d6589144cf019424f69b3ab289.tar.xz | |
hv_netvsc: Allocate the recv_buf buffers after NVSP_MSG1_TYPE_SEND_RECV_BUF
The recv_buf buffers are allocated in netvsc_device_add(). Later in
netvsc_init_buf() the response to NVSP_MSG1_TYPE_SEND_RECV_BUF allows
the host to set up a recv_section_size that could be bigger than the
(default) value used for that allocation. The host-controlled value
could be used by a malicious host to bypass the check on the packet's
length in netvsc_receive() and hence to overflow the recv_buf buffer.
Move the allocation of the recv_buf buffers into netvsc_init_but().
Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 0ba35fe91ce34f ("hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/hyperv/netvsc.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 0fba8257fc11..9db1ea3affbb 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -311,7 +311,7 @@ static int netvsc_init_buf(struct hv_device *device, struct nvsp_message *init_packet; unsigned int buf_size; size_t map_words; - int ret = 0; + int i, ret = 0; /* Get receive buffer area. */ buf_size = device_info->recv_sections * device_info->recv_section_size; @@ -405,6 +405,16 @@ static int netvsc_init_buf(struct hv_device *device, goto cleanup; } + for (i = 0; i < VRSS_CHANNEL_MAX; i++) { + struct netvsc_channel *nvchan = &net_device->chan_table[i]; + + nvchan->recv_buf = kzalloc(net_device->recv_section_size, GFP_KERNEL); + if (nvchan->recv_buf == NULL) { + ret = -ENOMEM; + goto cleanup; + } + } + /* Setup receive completion ring. * Add 1 to the recv_section_cnt because at least one entry in a * ring buffer has to be empty. @@ -1549,12 +1559,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, for (i = 0; i < VRSS_CHANNEL_MAX; i++) { struct netvsc_channel *nvchan = &net_device->chan_table[i]; - nvchan->recv_buf = kzalloc(device_info->recv_section_size, GFP_KERNEL); - if (nvchan->recv_buf == NULL) { - ret = -ENOMEM; - goto cleanup2; - } - nvchan->channel = device->channel; nvchan->net_device = net_device; u64_stats_init(&nvchan->tx_stats.syncp); |