summaryrefslogtreecommitdiff
path: root/net/vmw_vsock
diff options
context:
space:
mode:
authorAndrea Parri (Microsoft) <parri.andrea@gmail.com>2022-04-28 17:51:03 +0300
committerWei Liu <wei.liu@kernel.org>2022-04-28 18:01:14 +0300
commit71abb94ff63063f0cb303ac7860568639c10f42e (patch)
tree11e687a3854453aa36854c77b33781bd82206d1b /net/vmw_vsock
parenta765ed47e45166451680ee9af2b9e435c82ec3ba (diff)
downloadlinux-71abb94ff63063f0cb303ac7860568639c10f42e.tar.xz
hv_sock: Check hv_pkt_iter_first_raw()'s return value
The function returns NULL if the ring buffer doesn't contain enough readable bytes to constitute a packet descriptor. The ring buffer's write_index is in memory which is shared with the Hyper-V host, an erroneous or malicious host could thus change its value and overturn the result of hvs_stream_has_data(). Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://lore.kernel.org/r/20220428145107.7878-2-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
Diffstat (limited to 'net/vmw_vsock')
-rw-r--r--net/vmw_vsock/hyperv_transport.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index e111e13b6660..943352530936 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg,
if (need_refill) {
hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan);
+ if (!hvs->recv_desc)
+ return -ENOBUFS;
ret = hvs_update_recv_data(hvs);
if (ret)
return ret;