iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hv_netvsc: Add range checking for rx packet offset and length

Browse Source 
This patch adds range checking for rx packet offset and length.
It may only happen if there is a host side bug.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Haiyang Zhang 2018-03-22 12:01:14 -07:00 committed by David S. Miller
parent 5c71dadbb4
commit c5d24bdd29
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/net/hyperv/hyperv_net.h
View File

@ -793,6 +793,7 @@ struct netvsc_device {
/* Receive buffer allocated by us but manages by NetVSP */
void *recv_buf;
u32 recv_buf_size; /* allocated bytes */
u32 recv_buf_gpadl_handle;
u32 recv_section_cnt;
u32 recv_section_size;

17
drivers/net/hyperv/netvsc.c
View File

@ -282,6 +282,8 @@ static int netvsc_init_buf(struct hv_device *device,
goto cleanup;
}
net_device->recv_buf_size = buf_size;
/*
* Establish the gpadl handle for this buffer on this
* channel. Note: This call uses the vmbus connection rather
@ -1095,11 +1097,22 @@ static int netvsc_receive(struct net_device *ndev,
/* Each range represents 1 RNDIS pkt that contains 1 ethernet frame */
for (i = 0; i < count; i++) {
void *data = recv_buf
+ vmxferpage_packet->ranges[i].byte_offset;
u32 offset = vmxferpage_packet->ranges[i].byte_offset;
u32 buflen = vmxferpage_packet->ranges[i].byte_count;
void *data;
int ret;
if (unlikely(offset + buflen > net_device->recv_buf_size)) {
status = NVSP_STAT_FAIL;
netif_err(net_device_ctx, rx_err, ndev,
"Packet offset:%u + len:%u too big\n",
offset, buflen);
continue;
}
data = recv_buf + offset;
trace_rndis_recv(ndev, q_idx, data);
/* Pass it to the upper layer */