| Message ID | 20220420200720.434717-2-parri.andrea@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | hv_sock: Hardening changes | expand |
From: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Sent: Wednesday, April 20, 2022 1:07 PM > > The function returns NULL if the ring buffer doesn't contain enough > readable bytes to constitute a packet descriptor. The ring buffer's > write_index is in memory which is shared with the Hyper-V host, an > erroneous or malicious host could thus change its value and overturn > the result of hvs_stream_has_data(). > > Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> > --- > net/vmw_vsock/hyperv_transport.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c > index e111e13b66604..943352530936e 100644 > --- a/net/vmw_vsock/hyperv_transport.c > +++ b/net/vmw_vsock/hyperv_transport.c > @@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, > struct msghdr *msg, > > if (need_refill) { > hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan); > + if (!hvs->recv_desc) > + return -ENOBUFS; > ret = hvs_update_recv_data(hvs); > if (ret) > return ret; > -- > 2.25.1 Reviewed-by: Michael Kelley <mikelley@microsoft.com>
On Wed, Apr 20, 2022 at 10:07:16PM +0200, Andrea Parri (Microsoft) wrote: >The function returns NULL if the ring buffer doesn't contain enough >readable bytes to constitute a packet descriptor. The ring buffer's >write_index is in memory which is shared with the Hyper-V host, an >erroneous or malicious host could thus change its value and overturn >the result of hvs_stream_has_data(). > >Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> >--- > net/vmw_vsock/hyperv_transport.c | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c >index e111e13b66604..943352530936e 100644 >--- a/net/vmw_vsock/hyperv_transport.c >+++ b/net/vmw_vsock/hyperv_transport.c >@@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg, > > if (need_refill) { > hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan); >+ if (!hvs->recv_desc) >+ return -ENOBUFS; > ret = hvs_update_recv_data(hvs); > if (ret) > return ret; >-- >2.25.1 > Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c index e111e13b66604..943352530936e 100644 --- a/net/vmw_vsock/hyperv_transport.c +++ b/net/vmw_vsock/hyperv_transport.c @@ -603,6 +603,8 @@ static ssize_t hvs_stream_dequeue(struct vsock_sock *vsk, struct msghdr *msg, if (need_refill) { hvs->recv_desc = hv_pkt_iter_first_raw(hvs->chan); + if (!hvs->recv_desc) + return -ENOBUFS; ret = hvs_update_recv_data(hvs); if (ret) return ret;
The function returns NULL if the ring buffer doesn't contain enough readable bytes to constitute a packet descriptor. The ring buffer's write_index is in memory which is shared with the Hyper-V host, an erroneous or malicious host could thus change its value and overturn the result of hvs_stream_has_data(). Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> --- net/vmw_vsock/hyperv_transport.c | 2 ++ 1 file changed, 2 insertions(+)