openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

hv_netvsc: Fix validation in netvsc_linkstatus_callback() 

Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations.  Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.

Reported-by: Dexuan Cui <decui@microsoft.com>
Suggested-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 505e3f00c3 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Andrea Parri (Microsoft) 2021-03-01 19:25:30 +01:00 committed by David S. Miller
parent 9200f515c4
commit 3946688edb
3 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/hyperv/hyperv_net.h
View File

@ -229,7 +229,7 @@ int netvsc_send(struct net_device *net,
bool xdp_tx); bool xdp_tx);
void netvsc_linkstatus_callback(struct net_device *net, void netvsc_linkstatus_callback(struct net_device *net,
struct rndis_message *resp, struct rndis_message *resp,
void *data); void *data, u32 data_buflen);
int netvsc_recv_callback(struct net_device *net, int netvsc_recv_callback(struct net_device *net,
struct netvsc_device *nvdev, struct netvsc_device *nvdev,
struct netvsc_channel *nvchan); struct netvsc_channel *nvchan);

13
drivers/net/hyperv/netvsc_drv.c
View File

@ -744,7 +744,7 @@ static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb,
*/ */
void netvsc_linkstatus_callback(struct net_device *net, void netvsc_linkstatus_callback(struct net_device *net,
struct rndis_message *resp, struct rndis_message *resp,
void *data) void *data, u32 data_buflen)
{ {
struct rndis_indicate_status *indicate = &resp->msg.indicate_status; struct rndis_indicate_status *indicate = &resp->msg.indicate_status;
struct net_device_context *ndev_ctx = netdev_priv(net); struct net_device_context *ndev_ctx = netdev_priv(net);
@ -765,11 +765,16 @@ void netvsc_linkstatus_callback(struct net_device *net,
if (indicate->status == RNDIS_STATUS_LINK_SPEED_CHANGE) { if (indicate->status == RNDIS_STATUS_LINK_SPEED_CHANGE) {
u32 speed; u32 speed;
/* Validate status_buf_offset */ /* Validate status_buf_offset and status_buflen.
*
* Certain (pre-Fe) implementations of Hyper-V's vSwitch didn't account
* for the status buffer field in resp->msg_len; perform the validation
* using data_buflen (>= resp->msg_len).
*/
if (indicate->status_buflen < sizeof(speed) || if (indicate->status_buflen < sizeof(speed) ||
indicate->status_buf_offset < sizeof(*indicate) || indicate->status_buf_offset < sizeof(*indicate) ||
resp->msg_len - RNDIS_HEADER_SIZE < indicate->status_buf_offset || data_buflen - RNDIS_HEADER_SIZE < indicate->status_buf_offset ||
resp->msg_len - RNDIS_HEADER_SIZE - indicate->status_buf_offset data_buflen - RNDIS_HEADER_SIZE - indicate->status_buf_offset
< indicate->status_buflen) { < indicate->status_buflen) {
netdev_err(net, "invalid rndis_indicate_status packet\n"); netdev_err(net, "invalid rndis_indicate_status packet\n");
return; return;

2
drivers/net/hyperv/rndis_filter.c
View File

@ -620,7 +620,7 @@ int rndis_filter_receive(struct net_device *ndev,
case RNDIS_MSG_INDICATE: case RNDIS_MSG_INDICATE:
/* notification msgs */ /* notification msgs */
netvsc_linkstatus_callback(ndev, rndis_msg, data); netvsc_linkstatus_callback(ndev, rndis_msg, data, buflen);
break; break;
default: default:
netdev_err(ndev, netdev_err(ndev,