tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

hv_netvsc: Fix validation in netvsc_linkstatus_callback()

Contrary to the RNDIS protocol specification, certain (pre-Fe)
implementations of Hyper-V's vSwitch did not account for the status
buffer field in the length of an RNDIS packet; the bug was fixed in
newer implementations. Validate the status buffer fields using the
length of the 'vmtransfer_page' packet (all implementations), that
is known/validated to be less than or equal to the receive section
size and not smaller than the length of the RNDIS message.

Reported-by: Dexuan Cui <decui@microsoft.com>
Suggested-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Fixes: 505e3f00c3f36 ("hv_netvsc: Add (more) validation for untrusted Hyper-V values")
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Andrea Parri (Microsoft) and committed by
David S. Miller 3946688e 9200f515

+11 -6
+1 -1
drivers/net/hyperv/hyperv_net.h
··· 229 229 bool xdp_tx); 230 230 void netvsc_linkstatus_callback(struct net_device *net, 231 231 struct rndis_message *resp, 232 - void *data); 232 + void *data, u32 data_buflen); 233 233 int netvsc_recv_callback(struct net_device *net, 234 234 struct netvsc_device *nvdev, 235 235 struct netvsc_channel *nvchan);
+9 -4
drivers/net/hyperv/netvsc_drv.c
··· 744 744 */ 745 745 void netvsc_linkstatus_callback(struct net_device *net, 746 746 struct rndis_message *resp, 747 - void *data) 747 + void *data, u32 data_buflen) 748 748 { 749 749 struct rndis_indicate_status *indicate = &resp->msg.indicate_status; 750 750 struct net_device_context *ndev_ctx = netdev_priv(net); ··· 765 765 if (indicate->status == RNDIS_STATUS_LINK_SPEED_CHANGE) { 766 766 u32 speed; 767 767 768 - /* Validate status_buf_offset */ 768 + /* Validate status_buf_offset and status_buflen. 769 + * 770 + * Certain (pre-Fe) implementations of Hyper-V's vSwitch didn't account 771 + * for the status buffer field in resp->msg_len; perform the validation 772 + * using data_buflen (>= resp->msg_len). 773 + */ 769 774 if (indicate->status_buflen < sizeof(speed) || 770 775 indicate->status_buf_offset < sizeof(*indicate) || 771 - resp->msg_len - RNDIS_HEADER_SIZE < indicate->status_buf_offset || 772 - resp->msg_len - RNDIS_HEADER_SIZE - indicate->status_buf_offset 776 + data_buflen - RNDIS_HEADER_SIZE < indicate->status_buf_offset || 777 + data_buflen - RNDIS_HEADER_SIZE - indicate->status_buf_offset 773 778 < indicate->status_buflen) { 774 779 netdev_err(net, "invalid rndis_indicate_status packet\n"); 775 780 return;
+1 -1
drivers/net/hyperv/rndis_filter.c
··· 620 620 621 621 case RNDIS_MSG_INDICATE: 622 622 /* notification msgs */ 623 - netvsc_linkstatus_callback(ndev, rndis_msg, data); 623 + netvsc_linkstatus_callback(ndev, rndis_msg, data, buflen); 624 624 break; 625 625 default: 626 626 netdev_err(ndev,